UPDATE:

The sniffer configurator tool is ready to use in Simplicity Studio V4 after Q4 2018 release. 

It's available from the right click menu of a connected Debug Adapter in the Debug adapters panel of StudioV4.

This tool will work with any device supporting the RailTest sample application. This means it wont work for Modules like the MGM1x or MGM2x and legacy devices like the EM3xx series. 

This tool has presets for capturing Zigbee traffic on both 2.4 GHz and subGHz. 

<<You can find the old article below for sniffing with EFR32 devices>>

Any EFR32 can be easily turned into a Zigbee or Thread sniffer device using the Railtest sample application included in the free Flex SDK.

In order to do this follow the steps below:

1. Download the Flex SDK via Simplicity Studio V4.
2. Create a new Railtest sample application for your desired part using the default Profile and PHY settings (Generate and compile using GCC or IAR)
3. Load the built binary image onto your chosen EFR32 dev board.
4. Connect to the console of your EFR32.
5. In order to turn the Railtest image into a sniffer for 802.15.4 protocols like Zigbee and Thread you will need to issue the following commands over the console:
   1. > rx 0
      1. This will put the radio into an idle state so that you can configure it.
   2. > config2p4GHz802154
      1. This command configures the radio for the 802.15.4 phy
   3. > enable802154 rx 100 192 864
      1. Puts the radio into the right mode for 802.15.4 capture
   4. > setPromiscuousMode 1
      1. Puts the radio into promiscuous capture mode so it can act as a sniffer
   5. > setChannel <yourChannel, (11 - 26)>
      1. Sets the desired channel you wish to sniff.
   6. > rx 1
      1. Puts the radio back into receive mode.
6. Now simply capture from your device in the Network Analyzer and you should start seeing traffic captured from the network.