Welcome back, aspiring investigators!
In our previous articles, we explored what Meshtastic is and how you can use it for off-grid communication. It is one of the most interesting modern tools for resilient, long-range messaging, especially in environments where traditional infrastructure is unavailable or unreliable. If you have been following that series, you already know how powerful LoRa mesh networking can be.
Today, we are building on that foundation by looking at a tool that brings visibility, observability, and forensic depth to those same networks. The tool is called STRIDEtastic.
What is STRIDEtastic
STRIDEtastic is an open-source monitoring and observability framework for Meshtastic LoRa mesh networks. It was originally developed as an undergraduate research project at the Pontificia Universidad Católica de Chile, under the supervision of Prof. Miguel Gutiérrez Gaitán from the IoT-UC Research Lab. STRIDEtastic allows you to see what is happening across the mesh, investigate node behavior, capture forensic evidence, and even inject controlled test traffic. From multiple ingestion sources such as MQTT, serial radios, and TCP-connected nodes, the framework can decode MeshPackets and understand common Meshtastic payloads like NodeInfo, Position, Telemetry, NeighborInfo, and Routing data. When keys are available, it can even decrypt channel PSKs and PKI-based direct messages, which is extremely useful during authorized forensic analysis.
STRIDEtastic can store capture sessions in PCAP-NG format, which means you can later open the traffic in Wireshark using the bundled Lua dissector. One of the most professional features is its active publishing capability. You can run one-shot publishing jobs, reactive automation based on triggers, or periodic scheduled health checks and traceroutes using Celery workers. This means the framework is not only watching the mesh but can also continuously validate it.
The reporting side is equally strong. Through Grafana dashboards, you can visualize network health, geographic coverage, node telemetry, key health, and even specific threat-focused dashboards such as CVE-2025-53627 DM downgrade attempts.
Setting Up
The installation process is not overly difficult, but it does require several careful steps. The good news is that once it is working, the full stack feels very smooth.
We begin by cloning the repository and creating the environment file.
git clone https://github.com/0wulf/stridetastic.git
cd stridetastic
cp .env.template .envThe first service we bring up is TimescaleDB, since the rest of the stack depends on it for storing time-series telemetry and mesh observations.
docker compose up -d timescale_stridetastic
Next comes the Django setup. The repository instructions may not be enough in some environments, especially on Kali, so we make a small but important adjustment.
nano ./stridetastic_api/settings.py
Inside the settings file, you need to add the django.contrib.postgres line so Docker and the database integration work correctly. Once that is done, migrations should complete successfully.
docker compose run --rm api_stridetastic python /app/manage.py migrate
docker compose run --rm api_stridetastic python /app/manage.py createsuperuser
After that, we seed the default nodes, channels, and interfaces.
docker compose up -d timescale_stridetastic
docker compose run --rm api_stridetastic python /app/manage.py seeds
The final step before launching the full stack is another small fix inside the frontend configuration.
nano ./web_stridetastic/vitest.config.ts
In this file, remove the following block:
esbuild: {
jsx: 'automatic',
}
After saving the file, the full stack can finally be launched.
docker compose up -d
Once everything finishes, your services should be available.
The main dashboard is available on localhost port 3000. The API and Swagger documentation are on port 8000.The Django admin panel is also on port 8000 under /admin. Grafana is hosted on port 3001 with the default admin:admin credentials.
Exploring the Dashboard
Now we are finally ready to explore the dashboard. The overview page greets us with network-wide statistics. We can see the total number of nodes, how many are currently reachable, the average battery levels, signal strength trends, and other operational metrics.
Just below that, the network map shows the geographic spread of the nodes. This reveals how far the network extends and whether there are clusters and dead zones.
Another very interesting concept is Virtual Nodes. In STRIDEtastic, a virtual node is a fully software-based simulated Meshtastic node that exists only inside the framework. No physical LoRa radio is required. This is useful for sending controlled packets into the real mesh, running health checks, and testing reachability without touching hardware.
For example, you can use a virtual node to request telemetry from live nodes. Some nodes will share health metrics, uptime, voltage, location, and other valuable operational data. All of this flows back into the overview and helps build a richer picture of the network.
Another great feature is Node Key Health. This view actively watches for weak encryption keys and duplicated public keys across the mesh. Since Meshtastic nodes expose public keys in packets for signing and routing, duplicated or weak keys can become very real attack vectors for replay attacks or impersonation attempts.
Traffic capture saves data in PCAP-NG format, making it suitable for deeper forensic analysis in Wireshark.
Finally, we have Actions. From here, you can send messages, publish telemetry, issue traceroute requests, discover topology, measure latency, test reachability, and interact with the mesh in a very controlled way.
Beyond one-shot actions, you can also configure recurring services that continuously monitor live nodes, publish packets at regular intervals, or automatically respond when specific traffic patterns appear.
At this stage, the best way to learn is to experiment. Click through the topology, test the virtual nodes, run captures, and compare what you see in Grafana with what appears in Wireshark. If you are following along on Kali, our setup adjustments above should help make the deployment much smoother.
Summary
STRIDEtastic gives Meshtastic networks the visibility layer they often lack. It lets you monitor node health, topology, coverage, and link quality in real time while also using virtual nodes and automated checks to actively test the mesh. With dashboards, maps, telemetry, and Grafana reporting, it makes it much easier to understand performance issues and keep large LoRa mesh deployments healthy and reliable.
If you’re interested in digital forensics, we recommend our training for both beginners and those looking to advance their forensic skills.
Source: HackersArise
Source Link: https://hackers-arise.com/digital-forensics-analyzing-meshtastic-networks-with-stridetastic/