Wanted: ZigBee sniffs from live networks

[Nerivec]

Anyone willing and able to share ZigBee sniffs, please do so in here.
If you'd rather keep keys private, you can DM me on Discord instead.

https://www.zigbee2mqtt.io/advanced/zigbee/04_sniff_zigbee_traffic.html
https://github.com/Nerivec/ember-zli/wiki/Sniff

How to best approach this?

1. Determine a specific process (e.g. pairing via nested router)
2. Start and stop the sniff right before and after that process is executed
3. [if possible] Cut out the portion of the Zigbee2MQTT logs that corresponds to the sniff and join it too

Wanted list

• ZigBee groups
• ZigBee Green Power
  • From sinks
  • From proxies
• Install codes
• InterPAN/Touchlink

[dduransseau]

Hi @Nerivec following #19405 and request of ZigBee Green Power capture, issue #7975 seems interesting since it appear that another encryption logic is implemented capture. I had a look at the capture, during commissioning reply and Security Key is exchanged. It's a bit unclear to me if the commissioning logic used by the device is manufacturer specific or if it's standard. If it's a standard and you're interested to implement it, I can help since I can have access to a Schneider bridge and a Power Tag.

[dduransseau]

For the powertag link I not sure I can export the key unfortunately, I will have a look if I can find something in the logs.

[dduransseau]

Would it be possible that a coordinator use key ZigBeeAlliance09 for everything ? This is the only key I can find a trace of.

[Nerivec]

If it is using ZigBeeAlliance09 for APS, you should be able to sniff the network key by joining a regular device to it directly.
Look for the Transport Key packets right after association response, one will be APS encrypted (with ZigBeeAlliance09) but NWK plain, and you will see the network key in the APS payload.
Wireshark filter:

(zbee_aps.cmd.id == 0x05) && (zbee_aps.cmd.key_type == 0x01)

PS: If interested, here is a set of coloring rules tailored for ZigBee for Wireshark: ws-coloring.txt (View > Coloring Rules > Import)

[dduransseau]

Unfortunately I can't join regular device, PowerTag Link is a deprecated gateway that monitor energy using zigbee probe (powertag) and publish it trough Modbus. I tried to pair a zigbee seMetering device (since it povide same cluster and properties) without success. It's not clear to me if this device follow the zigbee protocol with a level of security not yet implemented or if it's a proprietary implementation which is of little interest.

[Nerivec]

The GP Commissioning state machine spec (A.3.9.1) is 18 pages long, so, lots of ways to do this...
Find me on Discord when you have some time, we can make a few attempts with code changes, see if we can get a better result from these GPDs.