Tutorial Zigbee 802 15 4

Tutorial: Zigbee / 802.15.4

What it is. Zigbee and other IEEE 802.15.4 networks (Thread, many smart-home hubs, lights and sensors) work on 2.4 GHz channels 11 to 26. OnAir lists the networks and devices from the headers that any sniffer sees: PAN IDs, coordinators, device addresses and frame types.

Read this first. Receive only. Encrypted payloads are not decrypted: the network key is not obtainable here, and OnAir does not try. Only frames sent in the clear are shown in full. Devices belong to other people; do not publish addresses. Check your local rules. See Legal and Privacy.

What you need

• A radio that reaches 2.4 GHz at 4 Msps (the mode needs 4 Msps). An RTL-SDR cannot; use a HackRF, PlutoSDR, LimeSDR or BladeRF.
• A 2.4 GHz antenna.
• Frequencies: channels 11 to 26 are 2405 MHz plus 5 MHz per channel step (2405, 2410, 2415 MHz and so on up to 2480 MHz; the database lists them all). The mode starts on 2405 MHz (channel 11). Use scan to find which channel your network uses.

Before you start

2.4 GHz is shared with Wi-Fi, so use a moderate gain. Zigbee traffic can be sparse: sensors may send once per minute. Hub traffic is the easiest to see.

Step by step

1. In the mode list open IoT & sensors and choose IoT, 2.4 GHz.
2. Pick the radio at 4 Msps and start the receiver.
3. Choose a Channel (11 to 26), or tick scan to go through all channels.
4. Open Networks, then Devices and Frames.

What you should see

Networks with their PAN ID, extended PAN ID, coordinator, number of devices and level. A device list with the vendor derived from the extended address. A live frame log.

Reading the screen

• Networks: PAN ID, Extended PAN ID, Coordinator, devices and Level.
• Devices: Short and Extended addresses, vendor, Role, Last seen.
• Frames: Time UTC, Ch, Type (beacon, data, association, ack and so on), Source > destination, Len, FCS (bad frames are marked). Zigbee network-layer and clear application-support headers are decoded. A frames-per-second plot is shown.

Options and settings

Filter, Level above, Show all, Copy and Clear as in other modes.

Troubleshooting

• Nothing. Zigbee may be off on your channel. Try scan.
• Frames but not readable. The payload is encrypted. Only headers show.
• Bad FCS. Weak signal or Wi-Fi interference.
• No such radio. An RTL-SDR does not reach 2.4 GHz at the needed rate.

Tips

Switching a Zigbee lamp on and off makes its hub send visible frames.

Legal and privacy notes

Passive. Never attempt to join or decrypt a network.

Under the hood

IEEE 802.15.4 O-QPSK at 2 Mchip/s, 250 kbit/s; MAC frames with FCS; Zigbee NWK layer headers.

Related

Mode-Zigbee-802-15-4, Tutorial-Bluetooth-LE, Tutorial-Wi-SUN-FAN, Tutorial-ANTplus-sensors, Modes, Main-window, Supported-radios, Troubleshooting, FAQ, Legal.