WIRESHARK USB SNIFFER INSTALL
WIRESHARK USB SNIFFER SOFTWARE

I got to work, following these (somewhat) helpful resources: Seemed like a better/easier/more flexible approach. I have been doing some work with Lua in my dayjob, and had read that wireshark supported dissector plugins could be written in Lua now. I have written a custom wireshark dissector before, but I wasn’t super happy with the mechanism. I was decoding them by hand, and then copying and pasting into a python script (I had pretty good sources of what all the bytes meant, I just had no good way of visualising the stream, which is where wireshark and this post comes in) I got wireshark to sniff the traffic, (Not going into that here, it’s relatively straightforward and documented enough on the web to get by) but as it’s a vendor specific protocol, it was just lots of bytes. Very initial probes using zigbee-viewer indicates that there is indeed three distinct routings: Zigbee routing.Earlier this week I was doing some reverse engineering and confirmation of behaviour for a USB tool. The next step will be to analyze the traffic, and understand the routing.

Now, by adding the transport key to the list of keys in Wireshark all the traffic on the network was able to be decrypted! Decrypted traffic So this is what I did: I found an IKEA Trådfri lightbulb and spent the frustrating time needed to get it to join the Philips Hue gateway ( resetting the bulb, searching for new lights). So, to find the network key we need to know the Key-Transport Key, and observe the traffic when a device joins. The Key-Transport Key is used whenever a new device joins the network with the sole purpose of encrypting the network key. Go to Edit -> Preferences -> Protocols -> ZigBee and edit the pre-configured keys: You can add these keys to Wireshark, and the Zigbee dissector will then try to decrypt traffic using them. These are apparently a well-kept secret or something, although widely available on the internet: Apparently there is a number of these, depending on the class of devices and type of network. The Key-Transport Key which is a pre-shared secret.How does a new device join the network then? It uses the… It is generated by the gateway, and shared by all the devices on the network. This is what we will ultimately need to find. The Network Key, which is unique to this Zigbee network.There is a number of keys that can be used to encrypt a single packet payload: This means the key to encrypt and decrypt is the same. Zigbee traffic can be encrypted with AES-128, which is a symmetric encryption scheme. At this point you can see the traffic but everything is encrypted… Encryption… Encryption everywhere! A very incomplete intro to Zigbee encryption This will launch a background process, and an instance of Wireshark that is monitoring the channel. I think channel 11 is the default, but it is displayed in the Hue app, under info for the bridge: sudo zbwireshark -c 11 Starting the sniffing is really easy, if you know the channel the Philips Hue is operating at.

The installation instructions are probably more up to date than this blog post.

WIRESHARK USB SNIFFER INSTALL

You need to install scapy, and a few dependencies. Installing KillerBee on Ubuntu is quite easy.

WIRESHARK USB SNIFFER SOFTWARE

The best software package seems to be KillerBee which supports both sniffing and injection however only sniffing with the CC2531. Fortunately, you do not need to change the stock firmware. After the dongle arrived I spent quite a while thinking that I need to replace the stock firmware, because of various old projects on GitHub ( Sensniff, ccsniffpiper, etc.). I purchased this USB CC2531 Zigbee sniffer, but others are probably equally good. I started by buying a Zigbee sniffer, I found that the Texas Instruments CC2531 chip is widely used, and available in a cheap USB package. Of course, if only I had a way of sniffing the Zigbee traffic I could diagnose these problems. I read a rumor online that the Hue lights and the other lights are actually on two different Zigbee networks. Most of the time the network works quite well, but some of the time a few of the lights become unreachable. I have a Philips Hue gateway at home that is connected to a number of Philips Hue lights, as well as some IKEA trådfri light bulbs, and a couple of OSRAM Lightify light strips.

Wireshark usb sniffer