What does ZigbeeAlliance09 and Nordic Examples keys mean in wireshart for nrf52 USB zigbee sniffer

[abdosalm]

I am using an nRF52840 USB dongle to sniff some Zigbee packets for a product I am developing. I am trying to use Wireshark to decode the messages shared.  I followed the steps specified here by the Nordic Semiconductor docs. However, since I am developing the product using an MCU from another vendor utilizing ZBOSS software, the only key I could configure in the software is the "NWK key" which is 0x00000000000000000000000000001234. 

Following the steps specified in the steps provided by Nordic, 2 keys are used, which are ZigbeeAlliance09 and NordicExamples set to some values, 5A:69:67:42:65:65:41:6C:6C:69:61:6E:63:65:30:39 and ab:cd:ef:01:23:45:67:89:00:00:00:00:00:00:00:00, but I can't understand what these numbers mean and how to modify them to get them to sniff my product packets.

I used the values as they were and tried to sniff packets from 2 Zigbee devices (one is a coordinator and another is an end device). And here is what I got in Wireshark:

I don't understand if this is correct sniffing or not since it's my first time dealing with zibee.

[Edvin]

Ok, I see. This trace is encrypted with the network key 0x00:00:00:00:00:00:00:00:00:00:00:00:00:00:12:34

Try opening the trace in Wireshark, then click Edit (from the file menu) -> Preferences -> Expand the "Protocols" menu on the left hand side, and scroll down to "Zigbee":

And follow this:

(use this string as your network key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:12:34 )

After you click "apply" and "ok", let it think for a second, and it should be able to decrypt the messages. It will also remember it for future sniffer traces (also the live ones).

Best regards,

Edvin