Cs4 - DevNonce has already been used

DevNonce is not f_count so disabling f_count verification will not disable dev_nonce verification. They are both used to prevent replay attacks, but essentially dev_nonce is the f_count for join-request and join-accepts, then after the device is joined it transitions to f_count.

I do not think there is an option to disable devNonce through Chirpstack, but there is the option on the activation page to “flush OTAA devNonces” perhaps you could use that for now.

While that might work as a workaround the real issue would be with your code, does the library you are using require/allow you to input the devNonce for joins? If so you want to ensure the devNonce increments and does not repeat, or else Chirpstack will decline it, assuming it is an attempt at a replay attack.

Here’s a helpful convo on devNonces if you need more info: DevNonce has already been used

1 Like