MeshCore illegal by default

MeshCore is booming in Europe and the UK — deservedly. But the firmware ships with a default airtime budget of roughly 50%, while the EU/UK 868 MHz sub-band it runs on allows a maximum of 10%. Newer firmware lets you fix this with one command. Almost nobody does. Which means that, out of the box, most MeshCore nodes on this side of the Atlantic are operating outside the law — and most of their owners have no idea.

Let's start with a compliment, because it is deserved.

MeshCore is a genuinely elegant piece of firmware. It is fast, it is efficient, its routing is clever, and it has earned its explosive popularity across Europe and the UK.

Now the uncomfortable part.

Flash it, pick the EU/UK preset, power it up — and you are, in all likelihood, transmitting illegally.

Not because you are a bad person.

Not because MeshCore is a bad project.

Because of a single default setting that almost nobody knows exists.

The number that matters: 50 versus 10

MeshCore's transmit behaviour is governed by an airtime budget. The firmware ships with that budget at its default value — which works out to roughly a 50% duty cycle.

In plain language: out of the box, a MeshCore node is allowed to spend up to half its time transmitting.

That default is perfectly reasonable where it was born. On the US 902–928 MHz band there is no fixed duty-cycle limit, so 50% is fine.

Europe and the UK are a different planet.

The 868 MHz sub-band that the EU/UK MeshCore presets live in (869.4–869.65 MHz) allows a maximum duty cycle of 10%. Most of the neighbouring 868 sub-bands are stricter still: 1%, or even 0.1%.

So the default setting permits five times the legal airtime budget — on the most generous sub-band available.

And here is the crucial legal mechanic, familiar to readers of our licence-free article: license-exempt operation is only lawful while the technical conditions are met. Duty cycle is one of those conditions. Exceed it and you are not "a mesh user bending a guideline". You are, legally speaking, transmitting without authorisation.

Illegal by default is not a rhetorical flourish. It is a factual description of the configuration state.

To be fair: newer firmware lets you fix it

Credit where credit is due.

Recent MeshCore firmware (v1.15.0 and later) implements duty-cycle limiting properly and exposes a clean command for it. One line at the CLI:

So the tools exist. The problem is not capability.

The problem is that compliance is opt-in.

The node does not ask. The flasher does not warn. The preset sets your frequency, bandwidth and spreading factor — and quietly leaves the duty cycle at 50%, waiting for you to know better.

And defaults are destiny. Decades of software experience say the same thing: the overwhelming majority of users never change a default they do not know exists. Why would they? The node works. Messages flow. The app says "sent". Nothing anywhere hints that the device is spending five times its legal airtime allowance.

Three kinds of operators, one shared problem

Walk through any EU or UK MeshCore community and you will meet three groups.

The unaware majority. They flashed via the webflasher, picked the regional preset like the guide said, gave the node a funny name, and joined the mesh. They have never heard of a duty cycle. They are breaking the law in complete good faith, which is a strange sentence to write but an accurate one.

The aware but dismissive. They know about the 10% limit. They consider it a suggestion. "The mesh works better without it." "Nobody checks anyway." "Everyone runs defaults." These are, word for word, the arguments that were losing on the CB band fifty years ago, and they have not improved with age.

The diligent few. They set their duty cycle, stretched their advert intervals, trimmed their hop counts, and put their contact info on their repeaters. They carry the compliance of the entire network on their shoulders — and they are outnumbered.

No blame lands on the first group. Very little machinery exists to inform them. But awareness has to start somewhere, and it might as well start with an article with an uncomfortable title.

Why this matters beyond your own node

We wrote a whole piece on the tragedy of the commons, so here is the short version.

A band full of 50% nodes does not just break rules. It breaks the mesh. Collisions climb, retries multiply, reliability evaporates — the network suffocates on its own traffic.

It also paints a target. Regulators such as the BIPT in Belgium or Ofcom in the UK enforce license-exempt bands mostly on complaints — until structural abuse gives them a reason not to. A node transmitting at five times its legal budget is trivial to locate, and "the firmware shipped that way" is not a recognised legal defence. Equipment seizure and administrative fines are.

And if the abuse starts disrupting the band's other tenants — utility meters, social alarms, building automation — the response becomes legislative: locked firmware, hardcoded limits, customs filtering uncertified boards. The bill lands on everyone, including the diligent few.

An entire hobby, made more expensive and more locked-down, by a default nobody changed.

The five-minute compliance check

Five minutes. That is the entire cost of moving from "illegal by default" to "legal by choice".

The structural fix: take MeshCore to the amateur bands

But let's be honest about the limits of articles like this one.

Awareness campaigns on an anonymous, license-exempt band are pushing water uphill. There is no identification, no coordination, no accountability — and anyone can key up, including people with distinctly less noble intentions. You cannot phone a node that refuses to say who it is.

The amateur radio service has none of these problems. Every transmission carries a callsign. Band plans are agreed and coordinated through the IARU. Misbehaviour gets noticed, identified and corrected — by culture first, by the regulator only when culture fails. It is a commons with a working government.

That is why we have published an open RFC for running MeshCore on amateur allocations, IARU Region 1 compliant:

github.com/Guru-RF/meshcore-rfc-iaru-r1

It covers the things a ham-based mesh must get right: callsign identification, coordinated frequency choices within the band plan, configuration discipline, and staying inside the amateur service's rules — including the encryption restrictions that apply there.

It is an RFC in the honest sense: a request for comments. If you are a licensed amateur and MeshCore interests you, read it, open an issue, send a pull request, tear a paragraph apart. The goal is a mesh that grows because it is well-governed, not despite being ungoverned.

A mesh with callsigns is a mesh with a future.

Closing thought

MeshCore is not the villain of this story. Neither are its users.

The villain is a silent default — a single number, set for a continent with no duty-cycle limits, quietly carried across an ocean to a continent with strict ones.

The fix is one command. The awareness is one article. The long-term answer is one RFC away.

Check your node tonight. If you have never typed set dutycycle, you already know what it is set to.

Interested in more technical content? Subscribe to our updates for in-depth RF articles and lab notes.

Questions or experiences to share? Feel free to contact RF.Guru for practical RF and antenna support.