Protocols & Packet Framing Hub
Over-the-air radio frequency frames begin as electromagnetic waveforms before silicon frontends, correlators, and microcontrollers translate them into actionable data. Understanding how modulation, framing, and routing interact prevents silent packet loss, RF congestion, and depleted batteries.
Chirp Spread Spectrum physics, SF7–SF12 airtime tradeoffs, hardware sync words (0x12 vs 0x34), MeshCore structured roles vs Meshtastic flooding, and LoRaWAN MAC headers.
802.11 MAC frame format, Beacon management frame inspection, 802.11ah 10x downclocked OFDM MCS rates, ESP-NOW connectionless action frames, and passive promiscuous mode.
Modulation physics of OOK, 2-FSK, and GFSK; Manchester/PWM/PPM timing diagrams; CC1101 hardware correlators; and dissecting a 433.92 MHz weather sensor frame.
ITU-T G.9959 MAC frame anatomy, Command Classes, Security 2 (S2) Curve25519 authenticated encryption, and Z-Wave Long Range 1-mile star topology with Dynamic Power Control.
01 · Master Protocol Comparison Matrix
Unlicensed spectrum supports a wide variety of wireless protocols, each engineered around specific compromises between throughput, range, battery longevity, and topology:
| Protocol | Spectrum Band | Topology | Throughput | Range (LOS) | Frame Size | Encryption / Security | Best Field Role |
|---|---|---|---|---|---|---|---|
| LoRa P2P | 433 / 868 / 915 MHz | Point-to-Point / Star | 0.3 – 22 kbps | 5 – 15+ km | 1 – 255 B | Custom / AES-128 | Ultra-low-power remote sensors, point-to-point telemetry links, borehole monitors |
| Meshtastic | 433 / 868 / 915 MHz | Managed Flood Mesh | 0.5 – 5.5 kbps | 3 – 10+ km / hop | Up to 237 B | AES-128 / AES-256-CTR | Off-grid ad-hoc tactical group messaging, outdoor community backcountry grids |
| MeshCore | 433 / 868 / 915 MHz | Structured Role Mesh | 0.5 – 5.5 kbps | 5 – 15+ km / hop | Up to 255 B | End-to-End Encrypted | Scalable metropolitan backbones, leaf client battery savings, store-and-forward Room Servers |
| Reticulum | Any (LoRa, HF, IP, Packet) | Cryptographic Mesh | 0.1 kbps – 100+ Mbps | Medium-independent | Up to 500 B | Curve25519, AES-128-CBC | Unbreakable sovereign off-grid networking, asynchronous resilient data pipes |
| LoRaWAN | EU868 / US915 / AS923 | Star-of-Stars (Gateways) | 0.3 – 50 kbps | 2 – 15 km | 51 – 222 B | Dual AES-128 (NwkSKey & AppSKey) | Municipal utility meters, agricultural smart soil probes, smart city logistics |
| Wi-Fi 4 / 6 / 7 | 2.4 / 5 / 6 GHz | BSS Infrastructure AP | 54 Mbps – 40+ Gbps | 15 – 70 m | Up to 2,304 B | WPA2/WPA3 (CCMP / GCMP-256) | High-speed local networking, streaming 4K video, bulk wireless data backhaul |
| Wi-Fi HaLow | Sub-1GHz (850–950 MHz) | Star BSS (Up to 8,191 STA) | 150 kbps – 15+ Mbps | 1 – 3 km | Up to 2,304 B | WPA3-SAE / WPA3-OWE | Long-range battery IP security cameras, agricultural drones, large-acreage farm sensors |
| ESP-NOW | 2.4 GHz (802.11 Action) | Direct Peer-to-Peer | ~1 Mbps | 50 – 200 m | Up to 250 B | Optional CCMP AES-128 | Sub-10ms latency sensor-to-relay triggers, local microcontrollers without Wi-Fi AP |
| Z-Wave Classic | Sub-1GHz (868 / 908 MHz) | 4-Hop Repeating Mesh | 9.6 – 100 kbps | 30 – 100 m / hop | Up to 64 B | Security 2 (S2 Curve25519 + AES-CCM) | Zero-Wi-Fi-interference residential smart home sensors, wall switches, and deadbolts |
| Z-Wave Long Range | Sub-1GHz (912 / 920 MHz) | Direct Star (4,000 Nodes) | 100 kbps DSSS-OQPSK | 1.6+ km (1 mile) | Up to 64 B | Security 2 (S2 Access Control) | Commercial multi-tenant properties, perimeter gates, large residential acreage |
| Bluetooth LE | 2.4 GHz ISM | Star / Point-to-Point | 125 kbps – 2 Mbps | 10 – 50 m | 27 – 251 B (LE 4.2+) | AES-128-CCM | Smartphone sensor pairing, low-duty wearable devices, location asset tags |
| Thread / Zigbee | 2.4 GHz (802.15.4) | Self-Healing Mesh | 250 kbps | 10 – 30 m / hop | Up to 127 B | AES-128-CCM (IPv6 6LoWPAN) | Matter-compatible smart bulbs, radiator valves, local low-power sensor fabrics |
02 · Universal Anatomy of an RF Packet
Regardless of frequency band or manufacturer, nearly all digital wireless protocols organize physical-layer transmissions into standard sequential functional blocks:
01 · Preamble
1–24 Bytes (or 8–12 symbols)Known bit pattern (01010101 in FSK/OOK, unmodulated chirps in LoRa). Gives receiver Automatic Gain Control (AGC) time to settle and phase-locked loop (PLL) time to lock on carrier.
02 · Sync Word / SFD
1–4 Bytes (or 2 chirps)Hardware start-of-frame delimiter (e.g., 0x12 for private LoRa, 0x34 for LoRaWAN, 0xF055 for Z-Wave, 0x2DD4 for FSK). Correlator triggers receiver interrupt and begins packet assembly.
03 · Physical Header
1–4 BytesContains physical frame parameters: payload length in bytes, forward error correction coding rate, header presence, and explicit/implicit mode flags.
04 · Transport / MAC Header
4–30 BytesSource address, destination address, packet sequence numbers, hop limits, encryption initialization vectors (IV/nonce), and frame control bits.
05 · Application Payload
1 to 2,000+ BytesThe actual user data: serialized C structs, Protocol Buffers (Meshtastic), BCD sensor values (weather stations), or encrypted JSON/CBOR objects.
06 · Frame Check Sequence (FCS)
1–4 BytesCyclic Redundancy Check (CRC-8, CRC-16, CRC-32) or Cryptographic Message Authentication Code (MIC). Invalid bits caused by RF noise or collisions result in silicon-level packet rejection.
03 · Diagnostic Protocol Sniffing & Engineering Verification
In RF field engineering, you cannot fix what you cannot measure. When nodes fail to join a network, drop telemetry, or drain batteries prematurely, passive protocol analysis reveals the root cause:
Duty Cycle & Airtime Audits
Passive logging confirms whether a sensor firmware bug is spamming packets and violating regional duty-cycle caps (e.g. ETSI 1% in EU868) or burning battery prematurely.
Co-Channel Collision Tracking
Measuring CRC error rates across channels reveals when uncoordinated nodes (e.g. multiple weather sensors or uncoordinated LoRa meshes) are trampling each other’s packets.
ACK & Retransmission Audits
Examining sequence numbers and retry flags highlights asymmetric link margins where a battery sensor hears an AP cleanly but lacks the output power to return ACKs.
Defensive Engineering & Diagnostic Charter
All monitoring workflows documented on OpenRF Note are strictly passive and non-intrusive. We cover protocol analysis, site surveying, open telemetry decoding, and RF health diagnostics. We do not cover packet injection, jammer circuits, deauthentication attacks, replay vulnerabilities, or penetration testing tools. Unlicensed radio operation relies on mutual technical compliance under FCC Part 15 and international rules.