Packet Sniffer¶

Ubiqua Protocol Analyzer¶

Download the Ubilogix Ubiqua packet sniffer software from: https://www.ubilogix.com/ubiqua/
To get the drivers for the CC2531EMK dongle install the TI Packet sniffer from: https://www.ti.com/tool/packet-sniffer
To program the CC2531EMK install TI Flash Programmer from: https://www.ti.com/tool/flash-programmer
To get the drivers for the CC2650/CC2652LP install the TI Packet sniffer 2 from: https://www.ti.com/tool/packet-sniffer
To program the CC2650/CC2652LP install UniFlash from: https://www.ti.com/tool/UNIFLASH

One of the following boards should be used:

Connect the CC2531EMK/CC2650LP/CC2652LP to the computer with Ubiqua installed.
If necessary, program your relevant sniffer hardware.
- For CC2531EMK, use the hex image sniffer_fw_cc2531.hex at C:\Program Files (x86)\Texas Instruments \SmartRF Tools\Packet Sniffer\bin\general\firmware and Flash Programmer.
- To use the CC2531EMK, the Cebal driver must be installed. If you have installed Flash Programmer, the Cebal driver should already be installed. However, if the driver is not installed, Ubiqua provides the necessary files for installing the Cebal driver. The installation files are found under C:\Program Files (x86)\Ubilogix\Drivers\TI\, with cebal2.* files for 32-bit Windows and cebal2_x64.* files for 64-bit Windows. Depending on which Windows version you are using, refer to a corresponding guide for how to install Windows drivers.
- For CC2650/CC2652LP, use sniffer_fw_15_4.hex at C:\Program Files (x86)\Texas Instruments \SmartRF Tools\SmartRF Packet Sniffer 2\sniffer_fw\bin\{your_device}\15.4 and UniFlash.

Connect your sniffing hardware to your PC.
Start Ubiqua.
Select Menu -> Device -> Add Device, and the Add Device window will appear.

Figure 88. ubiqua add device
In the Available Devices column click the Local Devices expander, and select your hardware, either the CC2531EMK or the Application COM Port of the CC2650/CC2652 LaunchPad.
For the CC2531EMK, follow the prompts to add the device. For the CC2650/CC2652LP, refer to the settings below:

Figure 89. Ubiqua select device
Right click on your device in the Device Manager window, and select the Protocol Stack option.
Click on the ZigBee checkbox.

Figure 90. Ubiqua select Zigbee protocol option
Choose the Channel
- In Z-Stack, the channel is set by DEFAULT_CHANLIST in f8wConfig.opts
From Ubiqua, select Menu -> Device Channel, and choose the matching channel:

Figure 91. Ubiqua channel selection
Enter the Default TC Link Key
- In order to decrypt Zigbee traffic, you will need to enter the default Trust Center Link Key into the Ubiqua keychain.
From Ubiqua, select Tools -> Options -> Security -> ‘Add’ -> Application or Trust Center Link Key

Enter the following key:

5a6967426565416c6c69616e63653039
Start Capture

From Ubiqua, Select Menu -> Device -> Start Device

Figure 92. Starting capture
If required, Select: Menu -> View -> Traffic View (or other selections) to view activity.

One of the following boards should be used:

Connect the CC2650/CC2652LP to the computer with Ubiqua installed and determine the correct COM Port for your LaunchPad. It will be the “XDS110 Class Application/User UART” port for your device, you can determine this in Windows by going to Device Manager > Ports
If necessary, program your relevant sniffer hardware.
- For CC2650/CC2652LP, use sniffer_fw_15_4.hex at C:\Program Files (x86)\Texas Instruments \SmartRF Tools\SmartRF Packet Sniffer 2\sniffer_fw\bin\{your_device}}\15.4 and UniFlash.

Connect your sniffing hardware to your PC.
Start SmartRF Packet Sniffer 2 Sniffer Agent and select Device Configuration
Select your IEEE channel to sniff
If your Sniffer Agent looks like this, you are ready to set up Wireshark:
Add the TI 15.4 Wireshark Dissector to Wireshark (assuming x64 installation)

Navigate to C:\Program Files (x86)\Texas Instruments\SmartRF Tools\ SmartRF Packet Sniffer 2\wireshark\plugins\2.4.x\ and copy ti802154ge-x64-2x.dll and tirpi-x64-2x.dll to C:\Program Files\Wireshark\plugins\2.4.3\
Open Wireshark go to Edit > Preferences > Protocols > Zigbee add the Zigbee TC Link Key

5a6967426565416c6c69616e63653039
Close Wireshark and create a new Desktop shortcut for Wireshark and add the following to the path: -i\\.\pipe\tiwspc_data -k

This will set up the Pipe that sends data from Sniffer Agent into Wireshark
Open Wireshark with the new shortcut and you will see Wireshark sniffing Zigbee data.