{"id":18674013,"url":"https://github.com/zsmartsystems/com.zsmartsystems.zigbee.sniffer","last_synced_at":"2025-04-12T01:32:04.257Z","repository":{"id":80456466,"uuid":"145240173","full_name":"zsmartsystems/com.zsmartsystems.zigbee.sniffer","owner":"zsmartsystems","description":"ZigBee sniffer using Ember NCP and routing packets to Wireshark for display","archived":false,"fork":false,"pushed_at":"2024-05-12T03:29:07.000Z","size":53,"stargazers_count":33,"open_issues_count":3,"forks_count":18,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-03-25T21:39:00.316Z","etag":null,"topics":["ezsp-protocol","silabs","wireshark","zigbee"],"latest_commit_sha":null,"homepage":null,"language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"epl-1.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zsmartsystems.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-08-18T17:37:30.000Z","updated_at":"2025-02-23T20:45:59.000Z","dependencies_parsed_at":"2023-12-24T20:42:26.801Z","dependency_job_id":null,"html_url":"https://github.com/zsmartsystems/com.zsmartsystems.zigbee.sniffer","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zsmartsystems%2Fcom.zsmartsystems.zigbee.sniffer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zsmartsystems%2Fcom.zsmartsystems.zigbee.sniffer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zsmartsystems%2Fcom.zsmartsystems.zigbee.sniffer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zsmartsystems%2Fcom.zsmartsystems.zigbee.sniffer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zsmartsystems","download_url":"https://codeload.github.com/zsmartsystems/com.zsmartsystems.zigbee.sniffer/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248504294,"owners_count":21115142,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ezsp-protocol","silabs","wireshark","zigbee"],"created_at":"2024-11-07T09:17:15.294Z","updated_at":"2025-04-12T01:32:03.799Z","avatar_url":"https://github.com/zsmartsystems.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# com.zsmartsystems.zigbee.sniffer\n\nThis project uses the ```com.zsmartsystems.zigbee.dongle.ember``` driver to provide a ZigBee sniffer interface for Wireshark, and optionally write the data to a Silabs compatible event log. The software will connect to an Ember dongle using a serial interface, and send UDP packets on port 17754 which can be received and displayed by Wireshark.\n\nTo use Wireshark, the loopback interface needs to be selected, and then a filter ```udp port 17754``` is used to only display ZigBee packets.\n\n```\nusage: ZigBeeSniffer\n-?,--help                         Print usage information\n-a,--ipaddr \u003cremote IP address\u003e   Set the remote IP address\n-b,--baud \u003cbaud\u003e                  Set the port baud rate\n-c,--channel \u003cchannel id\u003e         Set the ZigBee channel ID\n-o,--rotate \u003cseconds\u003e             Enable channel rotation and set rotation interval (seconds)\n-w,--rotate-start \u003cchannel id\u003e    Set the channel rotation range start\n-e,--rotate-end \u003cchannel id\u003e      Set the channel rotation range end\n-f,--flow \u003ctype\u003e                  Set the flow control (none | hardware | software)\n-l,--local                        Log times in local time\n-m,--maxpcap \u003clength\u003e             Maximum filesize for Wireshark files\n-p,--port \u003cport name\u003e             Set the port\n-r,--ipport \u003cremote IP port\u003e      Set the remote IP port\n-s,--silabs \u003cfilename\u003e            Log data to a Silabs ISD compatible event log\n-t,--timeout \u003cseconds\u003e            NCP restart timeout in seconds\n-w,--pcap \u003cfilename\u003e              Log data to a Wireshark pcap compatible log\n-d,--device-id \u003cdevice-id\u003e        Set the device ID that will be included in ZEP frame\n```\n\nNote that the IP address will default to the local host on the assumption that you are running Wireshark on the same computer as the sniffer. The ```ipport``` will default to 17754 which is the port used for the ZigBee Encapsulation Protocol - changing this may stop Wireshark displaying ZigBee data.\n\nExample command line -:\n\n```\njava -jar ZigBeeSniffer.jar -port /dev/tty.SLAB_USBtoUART -baud 115200 -flow hardware\n```\n\nThe software will print an output to the console for each packet that is received to allow confirmation it is working. When running Wireshark, these should also be seen in the Wireshark window.\n\nIf the NCP fails to receive a valid frame with the timeout period set with the ```timeout``` command line parameter, then the NCP will be restarted. This will allow the sniffer to recover from serial port or NCP communications problems. The timer defaults to 30 seconds.\n\nA compiled JAR file can be found in the releases here on GitHub, along with [further documentation](https://www.opensmarthouse.org/files/download/ZigBeeWiresharkSniffer.pdf).\n\nWhen using Wireshark to display the packets, the raw IEEE 802.15.4 packet received by the Ember module is first encapsulated in a \"TI CC24xx\" frame format, then in a ZEPv2 (ZigBee Encapsulation Protocol version 2) frame format before being sent using UDP.\nUsing the \"TI CC24xx\" frame format permit passing the RSSI value but has also limitations:\n* The \"RSSI\" value is correctly sent using a signed integer value in dBm\n* The \"FCS Valid\" field is always set to true as the Ember module discards invalid packets\n* The \"LQI Correlation Value\" is limited to a range of 0 to 127 (whereas the Ember module and the norm are defining this value for the range 0 to 255), so the displayed value is divided by 2.\n\nThe real LQI value reported by the module in the range 0 to 255 should be displayed in the ZigBee Encapsulation Protocol section, but due to a bug, this isn't actually the case (see https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16369).\n\nFor information on how the LQI is calculated in Silabs chips, refer to https://www.silabs.com/community/wireless/zigbee-and-thread/knowledge-base.entry.html/2017/08/15/lqi_in_silicon_labs-vvSq\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzsmartsystems%2Fcom.zsmartsystems.zigbee.sniffer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzsmartsystems%2Fcom.zsmartsystems.zigbee.sniffer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzsmartsystems%2Fcom.zsmartsystems.zigbee.sniffer/lists"}