Open Sniffer Installation

Open Sniffer acts as a probe which capturing 802.15.4 frames and send them to remote host computer. The frames are displayed, filtered and analyzed in Wireshark software.

Download, install and run Wireshark, branch 1.12.x is recommended.  Please select appropriate version for your operating system and architecture.

Select the Ethernet interface (linked to Open Sniffer) from the available newtwork interfaces and start capturing frames.

Wireshark implicitly shows all frames from wired and wireless networks delivered to the selected interface. Therefore, it is useful to apply 802.15.4 filter which is referred as “wpan”.

Now the host side is ready and you need to start the Open Sniffer probe via web interface. Point your browser to sniffer IP address (10.10.10.2) and press RUN. How to change sniffer’s channel or other params can be found here.

In following example two Zigbee nodes are used to generate some traffic. The Zigbee coordinator with NWK address 0x0000 and Zigbee router with NWK address 0x0001. You may generate your own traffic or download our captured data zigbee_demo (pcapng).

In the part two you have ended with some data captured and delivered to Wirehark. You may download the sample file zigbee_demo. This is basically joining process of device 0x0001 to the Zigbee network.

Let’s explain Wireshark settings in more detail.

Wireshark has default columns settings for wired Ethernet network, see picture below.

Columns are defined for the default Wireshark profile as follows:

Column name	Description
No.	Frame number counted from the start of capture in Wireshark. This is NOT number of packet received from Open Sniffer probe. It includes all packets delivered to the host’s ethernet interface
Time	Ethernet timestamp of the frame assigned by the operating system. This is NOT precise timestamp from Open Sniffer probe.
Source	Source Address
Destination	Destination Address
Protocol	Protocol
Length	Length of entire Ethernet frame including transportation overhead. This is NOT length of 802.15.4 frame
Info	Protocol details

From the table above it is obvious the default column settings are not associated with 802.15.4.  Therefore you can adjusted them to the 802.15.4 frame info. Let’s refresh the encapsulation scheme for each 802.15.4 frame delivered to the host (see picture below). While the grey colored protocols are used only to transport the 802.15.4 frame through a network infrastructure, the ZEP – Zigbee Encapsulated Protocol carries all the important information such as sequence number, timestamp or channel number  related to the every 802.15.4 captured by the Open Sniffer probe.

Although, Wireshark natively contains ZEP protocol v2, we provide ZEPv3 which is backwards compatible and brings additional information related to 802.15.4 band, channel page and precise timestamp information.

1. Download ZEPv3 plugin from download page.
2. Extract and copy plugin to the Wireshark plugin folder.
   Windows c:\Program Files\Wireshark\plugins\1.x.x\,
   Linux /usr/local/lib/wireshark/plugins/1.x.x/.
3. Start Wireshark. menu Analyze -> Enabled Protocols (CTRL+SHIFT+E)
4. Uncheck ZEP, check ZEPv3
5. Apply, OK.
6. h) If the new dissector is not applied go to menu Analyze -> Decode as -> ZEPv3 -> Apply, OK.

ZEPv3 contains fields illustrated in picture below:

Note: The procedure below describes how to adapt Wireshark columns to 802.15.4 frames. You may skip it if you use our Wireshark 802.15.4 profile. Just download the profile, unpack and copy it to the \wireshark\profiles. Finally you need to activate this profile by click on the bottom Wireshark bar “Profile” -> “802.15.4”

Adjusting columns procedure:

1. Right click on the columns header
2. Select Column Preferences
3. Adjust columns to 802.15.4

Adjusted Wireshark columns should seems like this:

Using our 802.15.4 profile with predefined color rules:

Wireshark is an extensive and powerful tool. We advise you to read its documentation page. It contains not only Wireshark itself but also several command line tools such editcap, mergecap, tshark, dumpcap etc. which might be useful where non trivial task are needed.