packet types 0 and 1 .. 45 % of the traffic ????

[on1arf]

Hi,

I run a local meshcore observer pushing the data to my own mqtt server to learn more about the behaviour of a meshcore network.

Looking at data of almost a complete month, I found something strange: 45 % of the packets on our network are packet type 0 or 1 (I think that these two packettypes are related)

Can somebody explain this? Why is almost half of the network traffic of these types.

g=df.groupby('packet_type_int').count().type/len(df)*100
g

packet_type_int
0 25.707646
1 19.224139
2 7.602222
3 2.085442
4 14.517297
5 19.004556
6 0.244381
7 3.299749
8 6.916674
9 0.028398
10 0.287578
11 1.081918

Edit: (22/07/2026)
Just did a new check: last 6 days
38979 packets in total, 9862 of message-type 0, 4523 of message-type 1.
So 36.9 % of the traffic is of these two message-types.
Also interesting is that type 10 (multipart) went from 0.2 to 4.3 percent and type 11 (control) went from 1.1 to 5.5 percent)

73
kristoff - ON1ARF

[jschrempp]

Do you get any insight if you look at the destination of these packets?

[on1arf]

OK, If I am correct, according the specs, the first two bytes of the datapacket (header) are the sha256 hash of the public key of the destination and the source nodes. So for the same source/destination it should always be the same. Correct no? (or am I missing something here?)

I just did a quick check on the network-capture I did in June, and the analyse indicates that the destination and source-hashes seem to be all over the place. I have 256 different source and destination hashes, and if I combine both I have over 1500 destination/source combinations (out of a possible 65536 space).

I will place the jupyter notebook online so we can double-check my analysis.

But my question remains. What is exactly the purpose of these packets?
And, if type-1 messages are "replies", why are they sent as flood?

[on1arf]

OK, I did some more analysis. (still on the dataset taken in Juni of about 3 weeks of data).

There are indeed over 1500 destination/source pairs in the message-type 0 messages, but for a lot of them, I only have a few packets. (considering there where quite a few days with good UHF radio-propagation, that is not that surprising).

So I made the two following top-10's (see below)

The Dest-Src are is destination/source pairs (first two octets of the message header). Next is the count and then the average length of the path of all packets received (routed to 0.1). This is a good indication of how far the source is from my location (in number of hops).

As you can see, for the 10 top of the type 0 message, only one source is relative close (average 2.4 hops from here), and all the others are actually quit to very far away.
Note that for most of the type-0 message, I do not see any (or just a few) return-packets which (as I see it) indicates that the "destination" station is also located away from our region.

For the type-1 messages, 5 of the top-1o are repeaters in our region.

Has somebody else already done similar analysis of the traffic in your region?
I would be interested to see if this kind of behaviour is common or if it is related to my region.

Message-type 0
DstSrc count Average_pathlen
8E31 4967 6.9
EB41 3543 2.4
02E9 2504 22.3
1F4D 1459 26.9
5CD3 1316 23.8
4F32 1072 20.5
12BB 1030 19.5
AD14 880 9.4
5F7A 874 16.4
EB7A 866 16.3

Message-type 1
DstSrc count Average_pathlen
059C 1685 15.1
416A 880 0
0368 864 16.2
E299 592 9.2
BB41 284 0.9
BB07 284 0.6
BBA4 263 1.4
C807 251 0.8
3CB7 235 7.6
E97A 228 24.6