How to sniff IKEA Trådfri with nRF Sniffer?

[Ole Morten]

Hello,

I'd like to look at the Zigbee network traffic to/from/between IKEA Trådfri devices, but am unable to see any traffic when using nRF Sniffer from Wireshark. Unfortunately, I have only a single nRF52840 DK, so I can't attempt sniffing any other Zigbee device... I am however relatively confident the Wireshark setup is working, since I'm able to use nRF Sniffer for BLE successfully (although that seems to use the other USB port on the DK).

I've tried all the channels I can choose from, and have attempted several factory resets of the bulb and the dimmer I'm trying to use to control them, but don't see any traffic on any of the channels at any time. I've also added the network keys as the documentation instructs, but I would expect that even without those I'd at least see encrypted traffic (and I guess the default keys aren't useful to decrypt Trådfri traffic anyway). What am I missing? What channel is Trådfri using?

[Edvin]

Hello Ole Morten,

Did you try to sniff for traffick after factory resetting the light bulb, before you pair it with the controller? In my experience, the light bulb is a bit difficult to factory reset. But it should be done when it stops responding to the IKEA light switch. You need to power cycle it 6 timer or something to do this.

I believe that the Trådfri bulb would send some beacon packets on all channels (cycle through them) before they are configured to a network (which will only operate on one channel).

Alternatively, did you test the CLI example with the light bulb? Check out the test description found here. Remember the "bdb legacy enable" command, which will include it to search for the light bulb.

BR,

Edvin

[Ole Morten]

Thanks for the answer, but it turned out to be as simple as a conflict between my serial terminal and Wireshark... It would have been great if Wireshark could have shown an error message when it apparently can't communicate with the DK, instead of just not doing anything... :-)