I wish to find out which LoRaWAN sensors are in the area and I presume that a gateway configured for a service provider only processes sensor packets registered to their LNS (LoRaWAN Network Server) using DevADDR. Therefore, IP network traffic from the gateway doesn’t not include data regarding all the received packets destined for another provider’s LNS.

Receiving all 8 channels simultaneous is essentially promiscuous mode or in RF parlance open squelch. And that would provide great capacity analysis, and of the overall sensor density.

I’m thinking the SX1302 gateway has a white list (or black list) and I’m assuming the SPI (Serial Programming Interface) is the communications channel. How do I read that SPI or an endpoint?

a means to read the SPI Registers that received the demodulated Lora signal and has provided a DevADDR.