Spreading-Factor Usage and Airtime in Urban LoRaWAN Traffic: Passive Gateway Monitoring with Machine Learning

Evidence on whether spreading-factor (SF) usage follows link quality in passively observed urban Long-Range Wide-Area Network (LoRaWAN) traffic remains limited. This study analyzes 54,893 Long-Range (LoRa) frames decoded over 30.2 days by a receive-only gateway in Ankara, Türkiye, using only physical-layer metadata and unencrypted message types. Join requests formed 73.44% of frames and 77.73% of airtime. A gradient-boosting classifier separated SF7 from SF12 frames with area under the precision–recall curve (PR-AUC) =0.9376; on a subsequent 24.9-day external test period, the F1 score was 0.7161, alongside a persistent frequency-offset shift. This discrimination relied largely on SF7 frames without a valid LoRaWAN uplink header; within LoRaWAN uplinks, link-quality variables outperformed frame size combined with frequency offset (PR-AUC 0.5010 versus 0.1129), also externally. At a 10 dB margin, 20.81% of SF12 join requests but only 0.31% of SF12 data uplinks had a signal-to-noise ratio sufficient for a lower SF; join requests accounted for 11.08 of 11.14 percentage points of counterfactual airtime reduction. Unsupervised clustering yielded six signal-quality regimes aligned with message class. Data-uplink SF usage is consistent with link-quality-driven assignment, whereas join requests dominate airtime; separating message classes was necessary for passive interpretation.