You have to add this key to the Pre-Configured Keys list. In the capture, you'll find a frame where the coordinator sends the network key to the new member of the network (wireshark points to this frame in every decrypted frame's security header in case you don't want to find it manually). Then you have to start capturing, and join a new device to the network. The keys have to be set in Wireshark in Edit/Preferences/Protocols/Zigbee/Pre-Configured Keys dialog (Security level has to be 'AES-128 Encryption, 32-bit Integrity Protection'. no, my tool is for ppl who has to live with the legacy Packet Sniffer (like me). In case you managed to route the zigbee packets to wireshark, then. Further down the page, the CC2531 USB Dongle is listed as supported for ZigBee protocol sniffing. It states that the software includes 'Dissectors for Wireshark' and that it 'uses Wireshark for packet display and filtering'. I found reference to ccsniffpiper in a very informative PDF document explaining how to set up and use Wireshark up to do ZigBee sniffing.ĮDIT - I should have just looked at the information on TI's download page for the new version of their SmartRF Packet Sniffer software. I plan to try this solution if the new TI sniffer software doesn't do the trick.

I plan on trying this solution first when I receive my CC2531. The main advantage of this solution is that it works with the original TI firmware for the CC2531, and just creates a pipe that makes the packets available to Wireshark. If you have a Mac, there's also a Python based solution called ccsniffpiper here. The only downside is that it seems it hasn't been updated since it was released in 2013.

It requires some initial setup in Wireshark, but apparently should do the trick. I can't try it out yet, but my research on a solution for getting packets from the CC2531 sniffer to Wireshark for decryption decoding keeps turning up an open source custom firmware + Windows or Ubuntu client solution called ZBOSS Sniffer.

Zigbee packet sniffer wireshark