Real-time LoRaWAN traffic analyzer for ChirpStack. Captures uplinks, downlinks, join requests, and TX acknowledgements via MQTT, stores everything in ClickHouse, and serves a web dashboard for monitoring and analysis.

• Dashboard -- gateway tabs, operator/device tree, traffic charts, channel/SF distribution, duty cycle, device breakdown
• Device detail view -- per-device FCnt timeline, packet loss, RSSI/SNR trends, interval histogram, SF/frequency/gateway distributions
• Live packet feed -- real-time WebSocket stream with packet type, RSSI range, and ownership filters
• Operator identification -- built-in LoRa Alliance NetID database (175+ operators), plus custom prefix mappings
• Visibility filtering -- separate "my devices" from foreign traffic using DevAddr prefix rules
• Join request tracking -- grouped by JoinEUI with timeline and manufacturer lookup
• Session tracking -- correlates join requests with subsequent data uplinks
• Airtime calculation -- per-packet, based on Semtech SX127x datasheet formulas

The analyzer connects directly to your ChirpStack installation's MQTT broker -- the same one that ChirpStack Gateway Bridge publishes to. No extra MQTT server needed.

cp config.toml.example config.toml

Edit config.toml and set mqtt.server to your ChirpStack MQTT broker:

[mqtt]
server = "tcp://your-chirpstack-mqtt:1883"
username = ""
password = ""
topic = "eu868/gateway/+/event/up"
format = "protobuf"

• server -- the MQTT broker that ChirpStack Gateway Bridge publishes to
• topic -- the region prefix (eu868, us915, as923, etc.) must match your Gateway Bridge config. The analyzer automatically derives downlink and ack topics from this.
• format -- protobuf for ChirpStack v4 (default), json for v3 or JSON marshaler

Finding your MQTT broker address from Docker:

If unsure, check your ChirpStack docker-compose.yml for the mosquitto/EMQX service name, or your chirpstack-gateway-bridge.toml for the MQTT server address.

docker compose up -d

This starts two containers:

Dashboard at http://localhost:15337. Packets appear as soon as gateways publish to the broker.

To check logs:

docker compose logs -f analyzer

Label your own networks. These override the built-in NetID database:

[[operators]]
prefix = "26000000/20"          # hex DevAddr prefix / bit length
name = "My Network"
known_devices = true            # marks as "my devices" for visibility filter
color = "#3b82f6"               # dashboard color

# multiple prefixes per operator
[[operators]]
prefix = ["26011234/32", "26015678/32"]
name = "My Sensors"
known_devices = true

Prefix format: AABBCCDD/N -- the upper N bits of the DevAddr are compared. 26000000/20 matches any DevAddr starting with 0x26000....

Suppress specific traffic from the UI:

[[hide_rules]]
type = "dev_addr"               # or "join_eui"
prefix = "26000000/20"
description = "Hide my sensors"

Both operators and hide rules can also be managed at runtime via the API (see below).

All other settings ([clickhouse], [api]) have sensible defaults for Docker -- see config.toml.example for details.

Most endpoints accept hours (time window, default varies) and gateway_id (filter by gateway) query parameters. Endpoints returning device data also support filter_mode (owned/foreign/all) and prefixes (comma-separated HEX/bits list).

Query parameters: types (comma-separated: data, join_request, downlink, tx_ack), rssi_min, rssi_max, filter_mode, prefixes.

# Rebuild after backend/source changes
docker compose build --no-cache analyzer && docker compose up -d

# Restart after config changes
docker compose restart analyzer

Frontend files (public/) are volume-mounted -- changes apply on browser refresh.

MIT