What does ZigbeeAlliance09 and Nordic Examples keys mean in wireshart for nrf52 USB zigbee sniffer

RE: What does ZigbeeAlliance09 and Nordic Examples keys mean in wireshart for nrf52 USB zigbee sniffer

Edvin — Thu, 05 Jun 2025 20:57:35 GMT

Ok, I see. This trace is encrypted with the network key 0x00:00:00:00:00:00:00:00:00:00:00:00:00:00:12:34

Try opening the trace in Wireshark, then click Edit (from the file menu) -> Preferences -> Expand the "Protocols" menu on the left hand side, and scroll down to "Zigbee":

And follow this:

(use this string as your network key: 00:00:00:00:00:00:00:00:00:00:00:00:00:00:12:34 )

After you click "apply" and "ok", let it think for a second, and it should be able to decrypt the messages. It will also remember it for future sniffer traces (also the live ones).

Best regards,

Edvin

RE: What does ZigbeeAlliance09 and Nordic Examples keys mean in wireshart for nrf52 USB zigbee sniffer

abdosalm — Thu, 05 Jun 2025 20:47:00 GMT

I am really sorry for the late reply, it has been a rough month for me. The '.pcapng' file is attached to this reply:

devzone.nordicsemi.com/.../3681.test1.pcapng

RE: What does ZigbeeAlliance09 and Nordic Examples keys mean in wireshart for nrf52 USB zigbee sniffer

Edvin — Wed, 07 May 2025 08:30:10 GMT

Can you save the sniffer trace as a .pcapng file and upload it here? I can't, based on your screenshot, tell if the sniffer is able to decrypt the messages.

Best regards,

Edvin