The sniffer configurator tool is ready to use in Simplicity Studio V4 after Q4 2018 release.
It's available from the right click menu of a connected Debug Adapter in the Debug adapters panel of StudioV4.
This tool will work with any device supporting the RailTest sample application. This means it wont work for Modules like the MGM1x or MGM2x and legacy devices like the EM3xx series.
This tool has presets for capturing Zigbee traffic on both 2.4 GHz and subGHz.
<<You can find the old article below for sniffing with EFR32 devices>>
Any EFR32 can be easily turned into a Zigbee or Thread sniffer device using the Railtest sample application included in the free Flex SDK.
In order to do this follow the steps below:
Download the Flex SDK via Simplicity Studio V4.
Create a new Railtest sample application for your desired part using the default Profile and PHY settings (Generate and compile using GCC or IAR)
Load the built binary image onto your chosen EFR32 dev board.
Connect to the console of your EFR32.
In order to turn the Railtest image into a sniffer for 802.15.4 protocols like Zigbee and Thread you will need to issue the following commands over the console:
> rx 0
This will put the radio into an idle state so that you can configure it.
> config2p4GHz802154
This command configures the radio for the 802.15.4 phy
> enable802154 rx 100 192 864
Puts the radio into the right mode for 802.15.4 capture
> setPromiscuousMode 1
Puts the radio into promiscuous capture mode so it can act as a sniffer
> setChannel <yourChannel, (11 - 26)>
Sets the desired channel you wish to sniff.
> rx 1
Puts the radio back into receive mode.
Now simply capture from your device in the Network Analyzer and you should start seeing traffic captured from the network.
Knowledge Base Articles
Zigbee and Thread Kits
Zigbee SDK
ZigBee and Thread
can you explain detain about this. Step 2, step 3, and step 6
0
If you take use of the zigbee sdk (EmberZNet), you could create a SoC application, and enable the 'mfglib' plugin. Then with similar steps to the above, you will issue the following CLIs in step 5:
If you know how to use 802.15.4 SubGHz, tell me how please.
0
@leoribg
I have not used railtest yet, but the attached Sniffer application based on SoC mode for your reference. I assume you have BRD4150C or BRD4170A in hand. There is a readme file inside.
Could you please advise, how to make a sniffer in case of the Thunderboard Sense 2 (BRD4166A)? I tried both mentioned above approaches (railtest and SoC), by generation and compiling the examples from the Flex and Ember ZNet SDKs, but without success. The option “Launch Console…” stays inactive in the Network Analyzer while connecting the board.
When you connect BRD4166A via the USB port, you could manually add the 'BRD4001A' to the configuration, then the 'Launch Console' becomes active. Hope this helps.
I don't have BRD4166A in hand, below is the screenshot for BRD4160A.
0
Hi @sslin
Many thanks for your prompt and effective response.
After adding the board, the sniffer works even with the reiltest example binary for the EFR32xg12 without the need to generate and build from example project.
Turning any EFR32 into a Zigbee or Thread Sniffer
UPDATE:
The sniffer configurator tool is ready to use in Simplicity Studio V4 after Q4 2018 release.
It's available from the right click menu of a connected Debug Adapter in the Debug adapters panel of StudioV4.
This tool will work with any device supporting the RailTest sample application. This means it wont work for Modules like the MGM1x or MGM2x and legacy devices like the EM3xx series.
This tool has presets for capturing Zigbee traffic on both 2.4 GHz and subGHz.
<<You can find the old article below for sniffing with EFR32 devices>>
Any EFR32 can be easily turned into a Zigbee or Thread sniffer device using the Railtest sample application included in the free Flex SDK.
In order to do this follow the steps below:
If you take use of the zigbee sdk (EmberZNet), you could create a SoC application, and enable the 'mfglib' plugin. Then with similar steps to the above, you will issue the following CLIs in step 5:
* Plugin mfglib mfgenable 1
* Plugin mfglib start 0
* Plugin mfglib set-channel <yourChannel, (11 - 26)>
RAIL_IEEE802154_ConfigGB915MHzRadio
Its not working.
If you know how to use 802.15.4 SubGHz, tell me how please.
@leoribg
I have not used railtest yet, but the attached Sniffer application based on SoC mode for your reference. I assume you have BRD4150C or BRD4170A in hand. There is a readme file inside.
Regards,
Steven Lin
Hi @sslin
Could you please advise, how to make a sniffer in case of the Thunderboard Sense 2 (BRD4166A)? I tried both mentioned above approaches (railtest and SoC), by generation and compiling the examples from the Flex and Ember ZNet SDKs, but without success. The option “Launch Console…” stays inactive in the Network Analyzer while connecting the board.
Sincerely,
Anna
@AnnaR
When you connect BRD4166A via the USB port, you could manually add the 'BRD4001A' to the configuration, then the 'Launch Console' becomes active. Hope this helps.
I don't have BRD4166A in hand, below is the screenshot for BRD4160A.
Hi @sslin
Many thanks for your prompt and effective response.
After adding the board, the sniffer works even with the reiltest example binary for the EFR32xg12 without the need to generate and build from example project.
Sincerely,
Anna
@AnnaR
Thanks for your info, the ready-made railtest is indeed more convenient.
Regards,
Steven
Is it possible to sniff multiple channels at once? For example, if I wanted to sniff channels 18 and 20 simultaneously, how would I do that? Thanks!
Jonathan