These test scenarios have been performed in the LoRaWAN certification testing. A certification network server implementation would be needed.
– Modify RxDelay, RX1DRoffset, RX2Data rate, CFList in the join-accept
See http://www.multitech.net/developer/software/lora/conduit-mlinux-lora-communication/conduit-mlinux-advance-lora-configuration/
See rx1DatarateOffset, rx2Datarate
See frequencyEU to change the CFList
RxDelay cannot be modified with current network server. This will become available in next release.
– Sending the command MAC in the optional field
Sending AT+NLC will perform Link Check MAC command exchange.
There is no way to inject MAC commands through the network server in the optional field. MAC commands can only be sent with port 0 from an application.
– Sending a downlink with invalid sequence number
– Sending a downlink with invalid MIC
The network server will not generate these packets.
The NetworkSessionKey could be reconfigured for the device to generate invalid MIC.
One could add a UDP proxy between network server and packet forwarder and modify the packet to be transmitted. The MIC and FCNT values are in the clear. Changing the FCNT will create invalid MIC.
https://github.com/Lora-net/packet_forwarder/blob/master/PROTOCOL.TXT