Reading MAC address

[Hiro0]

Hi.

I have a question.

When sending packets from a ZIGBEE product (with TI CC2538 built in) and receiving them with an nRF52840 Dongle (Sniffer FW) and Wireshark, is it possible to read the MAC address of the CC2538 with Wireshark?

Is the MAC address usually written in an unencrypted field?

Thanks.

[Syed Maysum Abbas Zaidi]

Hi,

Yes, you can read the device MAC address in Wireshark, but only when the device joins the Zigbee network. During joining, the MAC layer address is visible because 802.15.4 does not encrypt MAC addresses. After the device joins, it switches to a 16‑bit short address, so the full MAC address may no longer appear in normal traffic.

So to capture the MAC address, please start the sniffer before the device joins the network.

Best Regards,
Syed Maysum

[Hiro0]

Thank you for your support.