Zigbee / 802.15.4 Lab

Smart-home devices — bulbs, sensors, locks, buttons — often talk over Zigbee. This chapter explains what Zigbee and IEEE 802.15.4 actually are, then uses POOM's built-in sniffer to capture that traffic to a .pcap you can open in Wireshark. It is a listening track: you observe real radio, you don't inject.

Responsible Use: capture only networks you own or are authorized to assess. Zigbee traffic can include your neighbours' devices — do not record, decode, or act on traffic that is not yours.

What Is Zigbee vs 802.15.4?

They are different layers of the same stack, and it helps to keep them straight:

IEEE 802.15.4 is the radio: the low-power physical and MAC layer in the 2.4 GHz band. It defines channels, framing and addressing — the plumbing.
Zigbee is a networking + application stack built on top of 802.15.4 (mesh routing, security, device profiles). Thread and Matter-over-Thread ride the same 802.15.4 radio with different upper layers.

POOM's sniffer works at the 802.15.4 layer, so it captures Zigbee and Thread frames — anything on those channels. That's why the commands are named cfg-154-* even though we casually call it "the Zigbee sniffer."

Channels: 11 to 26

802.15.4 in the 2.4 GHz band uses channels 11 through 26. To capture a network's traffic you must be on its channel, so you either know the channel or you hop until you find activity. POOM supports both: a fixed channel, or hopping across the whole 11..26 range.

Finding the channel: if you don't know it, start with hopping to see where frames appear, then pin a fixed channel there for a clean, continuous capture. RSSI (cfg-154-rssi) tells you how strong the signal is on the current channel.

The `cfg-154-*` Command Set

Everything in this lab runs from the CLI. Here is exactly what each command does (this is the 802.15.4-only path; the multi-radio capture also has a menu front-end under PCAP SNF):

Command	What it does
`cfg-154-start`	Start the sniffer on the current fixed channel. Writes a `.pcap` to SD if a card is present, otherwise streams over UART. Prints the output and channel.
`cfg-154-hop-start`	Start the sniffer in hopping mode across channels 11..26 — good for discovery when you don't know the channel.
`cfg-154-ch <11..26>`	Set the channel. If the sniffer is already running fixed, it retunes live; otherwise it applies on the next start. Values outside 11..26 are rejected.
`cfg-154-rssi`	Read the current received signal strength (dBm) on the active channel. Only meaningful while the sniffer is running.
`cfg-154-stop`	Stop the sniffer and close the capture file.

Target support: the 802.15.4 radio exists on esp32c5. On other targets these commands report "not supported."

Try It — 802.15.4 Sniffer

Walk the cfg-154 workflow in a simulated console. Click a command or type your own.

Experiment 1 — Find a Zigbee Network by Hopping

Goal: locate which channel your own smart-home gear is on.

Run it:

cfg-154-hop-start
# watch which channel produces frames / RSSI activity
cfg-154-rssi
cfg-154-stop

Observe: while hopping, activity clusters around the channel your hub uses (Zigbee hubs commonly sit on channels like 11, 15, 20, or 25). Note that channel for the next experiment.

Experiment 2 — Fixed-Channel Capture to SD

Goal: record a clean, continuous capture of one network.

Run it (insert a microSD card first so it writes a file):

cfg-154-ch 15          # use the channel you found
cfg-154-start          # prints: File: /... on SD
# trigger some traffic: press a Zigbee button, toggle a bulb
cfg-154-rssi
cfg-154-stop

Observe: cfg-154-start prints the capture file path on SD. Interact with your own device to generate frames, then stop. Pull the .pcap onto a computer and open it in Wireshark — you'll see 802.15.4 MAC frames, and for unencrypted or keyed traffic, Zigbee network-layer detail.

No SD card? The sniffer falls back to streaming over UART instead of writing a file — useful for a quick look, but SD is better for a real capture you want to analyze.

Experiment 3 — Read Signal, Reason About Placement

Goal: use RSSI to understand mesh behaviour.

Run it: with a fixed-channel capture running, call cfg-154-rssi as you move POOM around a room relative to a device.

Observe: RSSI rises near the device and falls with distance and walls. This is why Zigbee is a mesh: weak links get routed around through router nodes (mains-powered bulbs and plugs). Watching RSSI is the intuition behind every "add a repeater" recommendation.

Making Sense of the Capture

In Wireshark, a POOM 802.15.4 capture typically shows:

MAC-layer frames — addressing, acknowledgements, and beacons that are always visible.
Zigbee NWK/APS layers — visible when traffic is unencrypted or when you hold the network key; otherwise payloads are ciphertext.
Thread/Matter frames — if devices on that channel use Thread rather than Zigbee.

You do not get keys for free: capturing proves the traffic exists and reveals metadata (who talks, how often, how strong), which is exactly the point of a passive lab. Decrypting your own network requires provisioning its key into Wireshark separately.

Where to Go Next

The same capture engine handles Wi-Fi and BLE too — see PCAP SNF in the BEAST Lab. For the full command reference and connection details, revisit the CLI Console. Every component behind this lab is listed in the Technologies Matrix.

Legal reminder: passive capture still records other people's devices if they are in range. Keep captures to networks you own or are authorized to test, and don't retain third-party traffic.