Ubisys IEEE 802.15.4 usb stic with wireshark..., Reference Manual

Page: 19 / 30

19 www.ubisys.de

9. Using Wireshark to Analyze Encrypted ZigBee PRO Traffic
You can use Wireshark to decrypt ZigBee PRO traffic on-the-fly. Both, secure NWK and APS frames,
can be dissected, as well as ZigBee Green Power.
To set the AES-CCM* security level according to your particular network setup, open the Preferences
for the ZigBee protocol. From the Edit menu, choose Preferences and expand the Protocols section.
Locate and
lect the appropriate security level. For example a ZigBee Home
Automation Network is going to use security level 5, which means AES-128 encryption and 32-bit
message integrity code.
Figure 12: ZigBee NWK Preferences in Wireshark
For a ZigBee home automation network, you may use the default Trust Center link key
as long as it has not
been changed via commissioning k security setup. Notice
that the label is used to identify which key has been used by Wireshark to decode the frame.
Figure 13: Entering a ZigBee link or network key
Once you have entered the key, Wireshark is able to decrypt the Transport Key APS command.
Now, open the network for new devices, i.e. permit joining, and let a device join the network to trigger
transmission of the transport key command from the trust center to the joining device.