// LoRa packet sniffer in the browser

>_ LoRaMon Web

A browser-based LoRa packet sniffer for RNode hardware — it connects to a device, listens in promiscuous mode, and streams every captured packet with live classification for Reticulum, Meshtastic and MeshCore. No install required.

00

What it is

LoRaMon Web is a browser port of Mark Qvist's LoRaMon. It turns an RNode into a passive LoRa sniffer: instead of joining a network, the radio is put into promiscuous mode and hands every frame it hears — regardless of protocol — straight to the browser. Nothing is transmitted, and nothing is installed; the whole tool is a single page.

As packets arrive they're timestamped, sized, shown as raw hex, and run through classifiers that try to recognise the three networks common on 868 MHz around here — Reticulum (RNS), Meshtastic and MeshCore. It's the fastest way to answer "is there anything on this frequency, and what is it?"

Open it at loramon.rns.moscow. It runs entirely client-side — captured packets never leave your machine.
01

Connecting a device

LoRaMon talks to an RNode two ways, and a link at the top of the device panel toggles between them:

USB (Web Serial)
Connects to a device plugged directly into this computer. Click Connect and pick the RNode's serial port from the browser prompt. This path needs the Web Serial API, so use Chrome, Edge, or another Chromium-based browser — Firefox and Safari won't offer it.
LAN (WebSocket)
Use Connect over LAN instead → to reach a device on your network over WebSocket, by its address — handy for an RNode that's hosting or joined to a WiFi network rather than wired to your machine.
Firmware matters. LoRaMon requires RNode_Firmware from flasher.rns.moscow. Stock or older firmware won't support everything the tool leans on — most notably the configurable sync word — and a page-top notice will remind you if it detects an incompatible build. If your device isn't an RNode yet, flash it first with the RNode Flasher.

Once connected, the button reads Connected, the firmware version is shown next to it, and Disconnect releases the device. The radio doesn't start listening until you've set — or picked a preset for — the parameters below.

02

Radio configuration

A radio only hears traffic that matches its own parameters, so a sniffer has to be tuned to the network you're looking for. The device panel exposes the full set: Frequency (MHz), Bandwidth, Spreading Factor, Coding Rate and Sync Word.

The quickest start is the Radio Preset dropdown, which fills every field at once for a known network. Pick one, and the rest follows:

PRESET Frequency Bandwidth SF CR Sync
Reticulum Moscow 868.825 MHz 125 kHz 10 4/7 0x12
MeshCore Moscow 868.731 MHz 62.5 kHz 7 4/7 0x12
Meshtastic (LF) 869.075 MHz 250 kHz 11 4/5 0x2b
Meshtastic (MF) 869.525 MHz 250 kHz 9 4/5 0x2b
The sync word is the catch. Two radios can share frequency, bandwidth and spreading factor but still ignore each other if their sync words differ — it's a network separator. Reticulum and MeshCore here both use 0x12; Meshtastic uses 0x2b. Setting it needs a firmware that understands the sync-word command, which is why the RNS.MOSCOW firmware is required. Edit any field by hand after choosing a preset to sweep a variation.
03

Classifiers & options

The options panel toggles what LoRaMon tries to make of each captured packet. Classification is best-effort — a packet is raw bytes, and each classifier decides whether those bytes plausibly parse as its protocol.

Classify RNS Packets
Recognises Reticulum packets and breaks the header down — header type, destination hash and type, context, hops — and labels announces specifically: LXMF, NomadNet, LXST, propagation-node announces, interface-discovery frames and more.
Classify Meshtastic Packets
Decodes Meshtastic frames using the project's public protocol definitions — packet id, from/to, hop limit and start, channel hash, portnum and payload.
Classify MeshCore Packets
Decodes MeshCore frames from that project's public protocol definitions — route type, payload type and version, transport codes and per-packet fields.
Signal Metrics
Shows the radio's reception quality for each packet — RSSI (signal strength) and SNR (signal-to-noise ratio), reported by the RNode alongside the payload.
A classifier can be greyed out if it isn't available for the current session; enabled ones run together, so a single packet can be tested against all three networks at once and only the one that fits gets a label.
04

Reading the capture

With a device connected and radio parameters set, the packet log fills as frames arrive — each row is one captured packet, newest at the top, with a running count in the header. When nothing has arrived yet it reads listening for packets…; before you connect, connect and start monitoring to capture packets.

Row summary
Each entry shows the capture time, the payload SIZE in bytes, and any protocol labels the enabled classifiers assigned it — RNS, Meshtastic or MeshCore. With Signal Metrics on, RSSI and SNR appear too.
Field breakdown
Hover a classification label to see the decoded fields — the individual header and payload values the classifier pulled out — or, if it couldn't decode the packet as that protocol, the reason why.
Hex viewer
Every packet can be inspected byte-for-byte in the hex viewer: offset markers down the side, hex bytes across, and an ASCII column — the ground truth behind any classification. Empty frames show (empty payload).
Save & clear
save on a row exports that packet; clear in the log header empties the capture and resets the count. The log lives only in the page — a reload starts fresh.
Some RNS packets are marked as part of a split transmission — a frame too big for one LoRa send. On the second half, the decoded "header" fields describe raw continuation data, not a real RNS header, and LoRaMon says so rather than pretending otherwise.

← All guides