• State TI Thinks Resolved
  • Locked Locked
  • Replies 3 replies
  • Answers 2 answers
  • Subscribers 55 subscribers
  • Views 414 views
  • Users 0 members are here
Support feedback
Options
Options
Similar topics

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC1352P: How to interpret SmartRF Packet Sniffer log

Timothy Murtaugh
Expert 1475 points
Part Number: CC1352P

Hello,

I'm debugging two custom boards that have the CC1352P processor. These boards are new, this is the first time I've used them. They are not communicating, and I'm trying to debug using a packer sniffer. One board is running firmware based on the zc_light sample app, the other running firmware based on the zed_switch sample app.

I've tried the same firmware on two LAUNCHXL-CC1352P-2 boards. They are commuicating and I see lot's ot Zigbee activity in Wireshark. However with my customs boads I see only the packets shown in this screenshot.

A packet is sent every 15 seconds. Is this packet coming from my ZC or ZED? How do I tell? Or is the packet sent by the sniffer board itself?

How can I identify a board by address? For example the packets I see have the same source and destination: 192.168.1.3, with a Zigbee address of 0x0000.

Is there some documenation on using the SmartRF Sniffer Agent? I don't mean installation guide, I mean documenation on what Zigbee packets I should see and how to interpret packets and addresses?

Also, if I attach sniffer logs to a post, what file should I attach? The pcapng files that is saved by Wireshark?

Sorry I'm new to using the packet sniffer and Wireshark. 

Thanks for your help,

Tim

PS I have SmartRF Sniffer Agent 1.8.0 and Wireshark 3.0.14.

  • 0
    TI__Guru**** 202216 points

    Hi Tim,

    You sniffer log only shows Link Status messages from the ZC (short address 0x0000) which occur every 15 seconds by default.  It is not coming from the sniffer board and there is no sign of life from the ZED, as a beacon request should be observable if it is attempting to join a network.  However the ZC most likely has disabled its network for joining (default 180 seconds) so you would need to re-enable this before the ZED is able to associate.  The ZC parent stochastically assigns a short address to its children during the association process, but association request/response packets contain IEEE address which are unique to each device and could be used to further identify which devices are sending such packets over-the-air.  It you wanted to share your sniffer log then the pcapng file would be suitable.  Here is the Zigbee Packet Sniffing Solutions FAQ for easy reference: https://e2e.ti.com/f/1/t/699648 

    Regards,
    Ryan

  • 0 in reply to Ryan Brown1
    Expert 1475 points

    Ryan

    When I installed SmartRF Packet Sniffer and Wireshark, I provided to Wireshark the Zigbee TC Link Key, as per TI's instructions. Does Wireshark use this key to decrypt Zigbee packets and show me the unencytped packets? Or do I need to provide some other key?

    Tim

  • 0 in reply to Timothy Murtaugh
    TI__Guru**** 202216 points

    Tim,

    Wireshark will use the Global TC Link Key to decrypt the NWK key when it is transported by the TC, then also be able to decrypt the TC Link Key update exchange.  It should then have all of the keys necessary to decrypt all network communications.  No other keys need to be provided unless a pre-configured NWK key or install codes are used.

    Regards,
    Ryan