CC2531EMK: Zigbee Sniffing with ZStack

Eliza Chelleng

Part Number: CC2531EMK
Other Parts Discussed in Thread: CC2531, Z-STACK

Hi all,

We are trying to use CC2531EMK dongle to sniff and inject IEEE 802.15.4 packets, and have couple of questions, appreciate your help on these :

Is it possible to use z stack firmware to do so? ZMAC and Mac directory in ZStack seems relevant but we are not sure.

Can we use CC2531 with Ztsack firmwares for sniffing(if we change some code) or do we necessarily need sniffer_sw_cc2531.hex ?

Ideally we would want to have the injection capability through python script that we can execute in the terminal.

over 5 years ago

0 YiKai Chen over 5 years ago

Guru 735455 points

Try to refer to e2e.ti.com/.../699648

0 Eliza Chelleng over 5 years ago in reply to YiKai Chen

Prodigy 105 points

Thanks for the information.
Any pointers on where and what code changes needed for Injection capability?

0 Toby Pan over 5 years ago in reply to Eliza Chelleng

TI__Mastermind 28140 points

Hi,

As far as I know, the CC2531 sniffer firmware is provided as an image only.

Packet Sniffer 2 includes IAR and CCS projects for the CC13x2 and CC26x2 sniffer firmware. This may be a good place to start.

Regards,

Toby

0 YiKai Chen over 5 years ago

Guru 735455 points

What do you mean to have the injection capability through python script that we can execute in the terminal?

0 Eliza Chelleng over 5 years ago in reply to YiKai Chen

Prodigy 105 points

From what we understand, the default TI 2531EMK firmware can be used for sniffing only. We want to use the same hardware to also inject custom packets in an 802.15.4 network. We would like to understand what modifications should be made at the app/MAC layers to enable such packet injection capabilities. Ultimately, we’ll use a command-line interface and/or scripts, supplying packet parameters that should trickle down to the USB interface and send those packets.

I’m looking at the z-stack 3.0.2 source code and trying to understand what source code changes would be necessary to achieve the above. Any help or pointers you can offer is much appreciated.

0 YiKai Chen over 5 years ago in reply to Eliza Chelleng

Guru 735455 points

TI doesn’t provide full source code of Z-Stack so I don’t think you can do this.

0 Ingo Wolf over 5 years ago in reply to YiKai Chen

Prodigy 135 points

I also would like to receive/trace 802.15.4 traffic and send packets, is there a firmware for already, just via serial over usb or similar?
Otherwise may be a feature request: just add another serial connection to usb in firmware for sending packets over.
Is it possible to program CC2531 just via USB? Some say there is a seriell bootloader, other not on that stick.

0 YiKai Chen over 5 years ago in reply to Ingo Wolf

Guru 735455 points

Using CC2531 sniffer FW, you can receive/trace 802.15.4 traffic but cannot send packet. And, TI doesn’t provide sniffer source code for developers so you cannot modify anything.

0 Ingo Wolf over 5 years ago in reply to YiKai Chen

Prodigy 135 points

delete

0 YiKai Chen over 5 years ago in reply to Ingo Wolf

Guru 735455 points

I couldn’t understand your question. Can you elaborate?

0 Ingo Wolf over 5 years ago in reply to YiKai Chen

Prodigy 135 points

Disregard and Thank You for Quick Response.

en.wikipedia.org/.../IEEE_802.15.4

Only 250K rate is in 802.15.4 for 2.4 GHz other makers say they can do different things with the 2M chiprate / bandwidth also, but that's not .15.4

0 Ingo Wolf over 5 years ago in reply to YiKai Chen

Prodigy 135 points

BTW I could find nothing about a serial / usb firmware loader in CC2531 manuals.

Is there may be some in flash when shipped?

Or no other option then flashing via 2 wire programmer?

0 YiKai Chen over 5 years ago in reply to Ingo Wolf

Guru 735455 points

For running 15.4 on CC2531, the data rate is 250 kbps. I remember I had read 2M bps data rate when using CC2531 in proprietary RF mode. As I know, there’s no FW preloaded on a new CC2531 chip and you have to use CC DEBUGGER to program CC2531 through JTAG.

0 Ingo Wolf over 5 years ago in reply to YiKai Chen

Prodigy 135 points

ZStack API Mac:

4.3.1 MAC_McpsDataReq ( )
4.3.1.1 Description
This function sends application data to the MAC for transmission in a MAC data frame.

Is a MAC data frame a 802.15.4 Frame ?

0 YiKai Chen over 5 years ago in reply to Ingo Wolf

Guru 735455 points

Yes, I think it’s 802.15.4 frame.

0 Ingo Wolf over 5 years ago in reply to YiKai Chen

Prodigy 135 points

e2e.ti.com/.../6758.Z_2D00_Stack-Monitor-and-Test-API.pdf

This document says the ZStack API is accessible sending serial packets over USB to the CC2531 with ZStack Firmware.

May be that is an approach for the problem.

May be ZStack Api can be configured to receive all packets and send it to the host and so monitor/sniff also.

Otherwise may be one CC2531 for sending with ZStack Firmware another one with sniff firmware for sniffing.

But I have to read into the details to be sure.

0 YiKai Chen over 5 years ago in reply to Ingo Wolf

Guru 735455 points

I suppose that’s ZNP/MT command interface and sniffer FW doesn’t provide such capability. If you want to use ZNP/MT command, I suppose you should run ZNP on your CC2531EMK.

Zigbee & Thread

Zigbee & Thread forum

CC2531EMK: Zigbee Sniffing with ZStack