Skip to content

Hardware Support

Jump to bottom
whisprer edited this page Nov 18, 2025 · 1 revision

Hardware Support

This page documents all Zigbee hardware adapters supported by the analyzer, including setup instructions, capabilities, and known limitations.

Supported Devices

Device Status Capture TX RSSI Price Availability
TI CC2531 ✅ Stable ✅ ❌ ✅ ~$10 Common
TI CC2652R 🚧 Beta ✅ 🚧 ✅ ~$25 Common
TI CC2652P 📋 Planned - - - ~$30 Common
TI CC2652RB 📋 Planned - - - ~$25 Moderate
Atmel RZRaven 📋 Planned - - - ~$50 Rare
nRF52840 Dongle 📋 Planned - - - ~$10 Common
HUSBZB-1 📋 Research - - - ~$40 Moderate

Troubleshooting

Device Not Detected

# Linux - check USB
lsusb | grep 0451

Check dmesg for errors


dmesg | tail -50 | grep -i usb


Windows - Device Manager


Look under "Ports (COM & LPT)"

Firmware Issues

If device behaves incorrectly:

  1. Re-flash firmware
  2. Try different firmware version
  3. Check antenna connection
  4. Test on different USB port/hub

Performance Issues

If experiencing packet drops:

  1. Use better hardware (CC2652 over CC2531)
  2. Reduce capture channel congestion
  3. Check USB bandwidth (other devices on same hub?)
  4. Increase system priority (nice level on Linux)

Contributing Hardware Support

Want to add support for new hardware? See Driver Development for:

  • Hardware abstraction trait implementation
  • Protocol reverse engineering tips
  • Testing requirements
  • Pull request process

Currently needed:

  • nRF52840 driver
  • Atmel RZRaven support
  • Sub-GHz radio support (CC1352)

See Also:

# Hardware Support

This page documents all Zigbee hardware adapters supported by the analyzer, including setup instructions, capabilities, and known limitations.

Supported Devices

Device Status Capture TX RSSI Price Availability
TI CC2531 ✅ Stable ✅ ❌ ✅ ~$10 Common
TI CC2652R 🚧 Beta ✅ 🚧 ✅ ~$25 Common
TI CC2652P 📋 Planned - - - ~$30 Common
TI CC2652RB 📋 Planned - - - ~$25 Moderate
Atmel RZRaven 📋 Planned - - - ~$50 Rare
nRF52840 Dongle 📋 Planned - - - ~$10 Common
HUSBZB-1 📋 Research - - - ~$40 Moderate

Legend:

  • ✅ Fully supported
  • 🚧 In development / Beta
  • 📋 Planned / Not yet implemented
  • ❌ Not supported (hardware limitation)

TI CC2531 USB Dongle

CC2531

Overview

The TI CC2531 is the most common and affordable Zigbee sniffer. It's a USB dongle based on Texas Instruments' 8051 core with a CC2530 radio.

Specifications

  • Chipset: CC2531 (8051 MCU + 2.4GHz radio)
  • Frequency: 2.4 GHz (2400-2483.5 MHz)
  • Channels: 11-26 (IEEE 802.15.4)
  • Sensitivity: -97 dBm (typical)
  • Output Power: +4.5 dBm
  • Interface: USB 2.0
  • Flash: 256KB
  • RAM: 8KB

USB IDs

Vendor ID:  0x0451 (Texas Instruments)
Product ID: 0x16AE (CC2531 EMK)

Features

✅ Supported:

  • Packet capture (promiscuous mode)
  • Channel selection (11-26)
  • RSSI reporting
  • LQI (Link Quality Indicator)
  • 2.4 GHz only

❌ Not Supported:

  • Packet injection/transmission
  • Sub-GHz (868/915 MHz)
  • Hardware encryption/decryption

Firmware

Required: CC2531 must be flashed with sniffer firmware.

Official Firmware:

Flashing:

# Using CC Debugger (hardware programmer required)
# 1. Install TI's Flash Programmer
# 2. Connect CC Debugger to CC2531
# 3. Flash sniffer_fw_cc2531.hex

Alternative - DIY Flashing:

# Using CCLoader (software-only, some boards)
git clone https://github.com/RedBearLab/CCLoader
cd CCLoader/Python
sudo python cc_loader.py -e -w sniffer_fw_cc2531.hex

Setup

Linux

  1. Create udev rule:
sudo tee /etc/udev/rules.d/99-cc2531.rules << EOF
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="16ae", MODE="0666"
EOF

sudo udevadm control --reload-rules
sudo udevadm trigger
  1. Verify device:
lsusb | grep 0451
# Should show: Bus XXX Device YYY: ID 0451:16ae Texas Instruments, Inc.

ls -la /dev/ttyACM* | grep 0451
# Should show: /dev/ttyACM0 or similar
  1. Test:
cargo run --example simple_capture

Windows

  1. Install drivers (usually automatic)
  2. Check Device Manager: Should appear as "TI CC2531 USB CDC"
  3. Note COM port: e.g., COM3
  4. Test:
cargo run --example simple_capture

macOS

Usually works without additional setup:

# Find device
ls /dev/tty.usbmodem*

# Test
cargo run --example simple_capture

Protocol

The CC2531 uses a simple serial protocol:

Frame Structure:

[SOF] [LEN] [CMD] [DATA...] [FCS]
 0xFE  1byte 1byte  n bytes   1byte

Commands:

  • 0x22: Start capture
  • 0x23: Stop capture
  • 0x24: Set channel
  • 0x80: Packet indication (device → host)

Example - Start Capture:

TX: FE 00 22 22  (Start on current channel)
RX: FE 01 22 00 23  (ACK)

Example - Packet Received:

RX: FE 1E 80 [19 bytes of data] [FCS]
    │   │  │
    │   │  └─ Packet indication
    │   └─ Length (30 bytes)
    └─ Start of Frame

Performance

  • Max packet rate: ~1000 packets/sec
  • Typical latency: 5-10ms
  • Buffer size: Limited (may drop packets under heavy load)

Purchasing

Where to Buy:

  • AliExpress: ~$8-12 (CC2531 + antenna)
  • Amazon: ~$10-15
  • eBay: ~$10-15

What to Look For:

  • "CC2531 USB Zigbee Sniffer"
  • "CC2531 EMK" (evaluation module)
  • Includes external antenna (better range)
  • Pre-flashed with sniffer firmware (rare, usually need to flash yourself)

Known Issues

  1. Buffer overflow: Can drop packets at high traffic rates

    • Solution: Use lower traffic channels or reduce network load

  2. Windows driver issues: Some boards don't enumerate properly

    • Solution: Use Zadig to install WinUSB driver

  3. Range limitations: ~10-20m line of sight

    • Solution: Use external antenna, get closer to target network

  4. No timestamp: Firmware doesn't provide hardware timestamps

    • Solution: Software timestamps in driver (less accurate)

TI CC2652R/P

CC2652

Overview

The TI CC2652 is a modern, more capable alternative to the CC2531. It features a 48MHz ARM Cortex-M4F processor and improved radio performance.

Specifications

  • Chipset: CC2652R/P (ARM Cortex-M4F + 2.4GHz radio)
  • Frequency: 2.4 GHz
  • Channels: 11-26
  • Sensitivity: -100 dBm (CC2652R), -105 dBm (CC2652P)
  • Output Power: +5 dBm (CC2652R), +20 dBm (CC2652P - high power variant)
  • Interface: USB 2.0
  • Flash: 352KB
  • RAM: 80KB

USB IDs

Vendor ID:  0x0451 (Texas Instruments)
Product ID: 0x16C8 (CC2652R)
            0x16C9 (CC2652P)
            0x16CA (CC2652RB)

Features

✅ Supported:

  • All CC2531 features, plus:
  • Higher packet capture rate
  • Better RSSI accuracy
  • Lower latency
  • Larger buffers (fewer dropped packets)

🚧 In Development:

  • Packet injection
  • TX power control
  • Sub-GHz support (CC2652P7)

Variants

CC2652R: Standard version

  • +5 dBm TX power
  • -100 dBm sensitivity
  • Most common variant

CC2652P: High-power version

  • +20 dBm TX power (100mW!)
  • -105 dBm sensitivity
  • External PA/LNA

CC2652RB: New revision

  • Similar to CC2652R
  • Improved manufacturing

Firmware

Required: Must be flashed with Z-Stack firmware in sniffer mode.

Firmware Options:

  1. Z-Stack: TI's official Zigbee stack
  2. Zigbee2MQTT firmware: Modified for better capture
  3. Custom firmware: For advanced users

Flashing:

# Using cc2538-bsl (Python tool)
pip install cc2538-bsl

# Flash firmware
cc2538-bsl.py -p /dev/ttyUSB0 -evw firmware.hex

Setup

Similar to CC2531, but uses different USB VID/PID:

# Linux udev rule
sudo tee /etc/udev/rules.d/99-cc2652.rules << EOF
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="16c8", MODE="0666"
SUBSYSTEM=="usb", ATTR{idVendor}=="0451", ATTR{idProduct}=="16c9", MODE="0666"
EOF

Protocol

Uses an extended version of the CC2531 protocol with additional commands:

  • 0x85: Set TX power
  • 0x88: Inject packet
  • 0x89: Get configuration

Performance

  • Max packet rate: ~5000 packets/sec
  • Typical latency: <2ms
  • Buffer size: Much larger than CC2531

Purchasing

Where to Buy:

  • Electrolama zig-a-zig-ah!: ~$25 (highly recommended)
  • Slaesh's CC2652RB stick: ~$25
  • AliExpress: Various clones ~$20-30
  • Official TI LaunchPad: ~$30

Recommended:

Current Status

⚠️ Beta Warning: CC2652 driver is functional but still in active development.

Working:

  • Basic packet capture
  • Channel selection
  • RSSI/LQI reading

In Progress:

  • Packet injection
  • Extended commands
  • Optimizations

Planned Hardware

nRF52840 Dongle (Nordic Semiconductor)

Status: 📋 Planned

Popular low-cost dongle with good Zigbee support:

  • ARM Cortex-M4F @ 64MHz
  • Excellent radio performance
  • USB dongle form factor
  • ~$10

Atmel RZRaven

Status: 📋 Planned

Legacy but capable platform:

  • Atmel AVR + 2.4GHz radio
  • LCD display
  • Joystick for standalone use
  • Becoming rare, ~$50+

HUSBZB-1 (Nortek)

Status: 📋 Research

Dual Zigbee/Z-Wave USB stick:

  • Zigbee + Z-Wave combo
  • Common in Home Assistant setups
  • May have limited sniffer capabilities

Hardware Requirements Summary

Minimum Requirements

For basic packet capture, you need:

  • USB 2.0 port
  • Supported dongle (e.g., CC2531)
  • Appropriate firmware flashed

Recommended Setup

For best experience:

  • CC2652R/P dongle
  • USB extension cable (for better positioning)
  • External antenna (improves range)
  • USB hub with individual power switches (for resets)

Professional Setup

For serious research/pentesting:

  • Multiple dongles (capture multiple channels)
  • CC2652P high-power variant (for injection)
  • Directional antennas
  • Laptop with good USB stack

Comparison Table

Feature CC2531 CC2652R CC2652P nRF52840
Price $ $$ $$$ $
Availability ⭐⭐⭐⭐⭐ ⭐⭐⭐⭐ ⭐⭐⭐ ⭐⭐⭐⭐
Capture Rate 1K pps 5K pps 5K pps 3K pps
Sensitivity -97 dBm -100 dBm -105 dBm -95 dBm
TX Power +4.5 dBm +5 dBm +20 dBm +8 dBm
Injection ❌ 🚧 🚧 📋
Range ~20m ~30m ~100m+ ~25m
Latency 5-10ms <2ms <2ms <3ms
Buffer Small Large Large Medium

Troubleshooting

Device Not Detected

# Linux - check USB
lsusb | grep 0451

# Check dmesg for errors
dmesg | tail -50 | grep -i usb

# Windows - Device Manager
# Look under "Ports (COM & LPT)"

Firmware Issues

If device behaves incorrectly:

  1. Re-flash firmware
  2. Try different firmware version
  3. Check antenna connection
  4. Test on different USB port/hub

Performance Issues

If experiencing packet drops:

  1. Use better hardware (CC2652 over CC2531)
  2. Reduce capture channel congestion
  3. Check USB bandwidth (other devices on same hub?)
  4. Increase system priority (nice level on Linux)

Contributing Hardware Support

Want to add support for new hardware? See Driver Development for:

  • Hardware abstraction trait implementation
  • Protocol reverse engineering tips
  • Testing requirements
  • Pull request process

Currently needed:

  • nRF52840 driver
  • Atmel RZRaven support
  • Sub-GHz radio support (CC1352)

See Also:

Clone this wiki locally