Overview Welcome to your ubisys This reference manual provides operating and maintenance instructions, command references etc. If you have any questions or need additional support, software or drivers, please visit our engineering support pages. http://www.ubisys.de/engineering/support.html www.ubisys.de...
Microsoft Windows Setting the Channel for Capture Linux Using Wireshark for IEEE 802.15.4 Captures (Quick Introduction) Using Wireshark to Analyze Encrypted ZigBee PRO Traffic Multiple-Channel Capture and Diversity Troubleshooting Physical Dimensions Ordering Information Declaration of Conformity Revision History Contact www.ubisys.de...
Notice that one device is capable of capturing data on one channel at a time. Simultaneous multiple-channel capture is supported by using a number of ubisys IEEE 802.15.4 devices, each operating on a different channel. Diversity capture is supported by using more than one ubisys IEEE 802.15.4 stick on the same channel.
Follow the instructions on the screen. When you are done, verify that the device has been installed correctly by opening Windows Device Manager. Your ubisys IEEE 802.15.4 device with Wireshark capture firmware should appear under the network adapter section.
Page 6
Right- -up menu that appears. Next, make sure that all protocol links are disabled. Figure 3: Network Adapter Properties You are done. Installation with recommended adapter settings is complete. The device can be used for capturing packets now. www.ubisys.de...
# sudo apt-get install linux-headers-$(uname –r) linux-libc-dev kernel-package You are also going to need the kernel sources, since ubisys provides a patch to the rndis_host.c driver module. The community patch and accompanying shell script have both been provided by Marcus Ihde-Meister and have been tested by ubisys on different hardware platforms.
Page 8
Notice: If certain hunks could not be applied, you should nevertheless continue to build. Now, build the patched kernel module: # make This results in an output like this: make -C /lib/modules/2.6.32-5-powerpc64/build/ M=/root/ubisys-m7b-rndis modules make[1]: Entering directory `/usr/src/linux-headers-2.6.32-5-powerpc64' CC [M] /root/ubisys-m7b-rndis/rndis_host.o Building modules, stage 2.
Page 9
In the interface list shown in Wireshark pick eth3 as the capture interface. Tested on ubuntu 12.04, i686, Kernel 3.2.0-32 and debian 6.0.6, ppc64, Kernel 2.6.32-5. www.ubisys.de...
Setting the Channel for Capture Microsoft Windows Your ubisys IEEE 802.15.4 USB stick with Wireshark sniffer firmware is capable of capturing packets on any of the 16 channels in the 2.4GHz band, i.e. channels 11-26 according to the IEEE 802.15.4 standard.
[349673.652872] rndis_host ieee802154 channel is 26 Now you can start Wireshark: # sudo wireshark & The channel is also shown in the ZigBee encapsulation Protocol dissector: Figure 5: Wireshark Capturing ZigBee Traffic on a PowerMac G5 Running Debian Linux 6.0.6 for PowerPC 64-bit www.ubisys.de...
Start Wireshark to begin a new live-capture. Figure 6: Wireshark Welcome Screen Notice that the interface list includes the ubisys IEEE 802.15.4 capture device. If it does not appear on your system and you recently installed the driver, please restart the packet capture driver (Winpcap), first.
Page 14
Figure 7: Wireshark Live-Capture in Progress... You can select any of the captured packets while the live-capture is still in progress. Two detail sections are available with decoded information as well as raw binary data: www.ubisys.de...
Page 15
Notice that the IEEE 802.15.4 frame is encapsulated in a ZEPv2 frame, which is transferred via UDP/IP, and Ethernet (RNDIS). The ZEP frame includes channel number information and an LQI value derived from individual correlation and RSSI values. www.ubisys.de...
Page 16
CC2420 format, i.e. the frame check sequence is not the value actually transmitted over the air. Instead of the 16-bit CRC, there is only one bit that determines whether the FCS was correct. The remaining Figure 9: Decoded IEEE 802.15.4 Packet with RSSI and Correlation Values www.ubisys.de...
Page 17
Figure 10: Example of a ZigBee PRO Link Status Frame www.ubisys.de...
Page 18
Figure 11: Raw Binary Packet Data Notice that Wireshark is a powerful tool with various filtering capabilities, capture options etc. Please refer to the Wireshark documentation for a complete coverage of all features, including remote capture, merging capture files, etc. www.ubisys.de...
Once you have entered the key, Wireshark is able to decrypt the Transport Key APS command. Now, open the network for new devices, i.e. permit joining, and let a device join the network to trigger transmission of the transport key command from the trust center to the joining device. www.ubisys.de...
Page 20
000102030405060708090a0b0c0d0e0f and can be added to the pre-configured keys just like the Trust Center link key. Depending on the version of Wireshark you are using, the software is also capable of learning the key automatically. www.ubisys.de...
While you could use multiple instances of Wireshark in order to run multiple captures and then merge the captures files, it is often more convenient to group all sticks and run a single capture (on all sticks). Figure 16: Selecting multiple interfaces for capture in Wireshark (here, five ubisys IEEE 802.15.4 USB Sticks) ...
Page 23
This can be achieved with Windows built-in network bridge feature. Open the network connections view and select the ubisys IEEE 802.15.4 adapters you want to group. Right-click on one of them and select the Bridge Connections command from the context menu that appears. This will create a network bridge.
Page 24
Edit the properties for the new connection and disable all protocols, as you have done for all the individual ubisys IEEE 802.15.4 adapters. You can add and remove other adapters from the group of bridged devices by adding or removing the check mark in the adapter selection area.
Make sure that you have disabled all networking protocols Make sure that the ubisys 802.15.4 networking adapter is enabled and has not been disabled by Windows network discovery algorithm Make sure that no enterprise security software, firewall or anti-virus program blocks the network adapter.
13. Ordering Information The following tables list the product variants available. Use the specified order code for your orders. Please contact ubisys support if you require any customization. Case Firmware variant Product Number Order Code Black Wireshark/RNDIS U0101-010110-02 9010 Light gray...
14. Declaration of Conformity ubisys technologies GmbH, Am Wehrhahn 45, 40211 Düsseldorf, Germany declare under our sole responsibility that the ubisys IEEE 802.15.4/ZigBee USB Gateway stick with RNDIS/Wireshark Firmware declaration relates are in conformity with the following directives and standards: Directive/Standard...
Minor corrections. Added diversity capture example and updated multiple capture interface information. Conformity statement included. 20/12/2012 Added instructions for Linux 16/06/2014 Added instructions for manually restarting Winpcap 05/12/2014 Added ZigBee Green Power to the list of protocols -of-the- and added a trouble-shooting section. www.ubisys.de...
Need help?
Do you have a question about the IEEE 802.15.4 usb stick with wireshark firmware and is the answer not in the manual?
Questions and answers