Application Note: JN-AN-1115 Protocol Analysis with Wireshark



Similar documents
Iridium Extreme TM Satellite Phone. Data Services Manual

Application Note: JN-AN-1155 JenNet Home Alarm System

INSTALLING AND USING ENTEL PROGRAMMER IN WINDOWS 7 Technical Support Bulletin

User Manual. Onsight Management Suite Version 5.1. Another Innovation by Librestream

Moxa Device Manager 2.0 User s Guide

Canon WFT-E1 (A) Wireless File Transmitter. Network Support Guide

Current Cost Data Cable User Guide. Installing and configuring the data cable

PREFACE iss.01 -

InventoryControl for use with QuoteWerks Quick Start Guide

GE Healthcare Life Sciences UNICORN Administration and Technical Manual

Metasys System Direct Connection and Dial-Up Connection Application Note

Printer Support Guide. FedEx Ship Manager Software

Moxa Device Manager 2.3 User s Manual

Configure SPLM 2012 on Windows 7 Laptop

Installation Instruction STATISTICA Enterprise Server

Allworx OfficeSafe Operations Guide Release 6.0

Lab - Using Wireshark to View Network Traffic

SOP085 - HELLER OVEN SOFTWARE INSTALLATION PROCEDURE. For version 6.2.x.x

Prestige 623R-T. Quick Start Guide. ADSL Dual-link Router. Version 3.40

GEVPlayer. Quick Start Guide

BASLER ACE QUICK INSTALLATION GUIDE

Operating Instructions

Networking Best Practices Guide. Version 6.5

Ethernet Radio Configuration Guide

Network Scanner Tool R3.1. User s Guide Version

AVG 8.5 Anti-Virus Network Edition

USER GUIDE. Ethernet Configuration Guide (Lantronix) P/N: Rev 6

Internet for Everyone In-Room Instructions January 2011 Version 1.3

EasyMP Multi PC Projection Operation Guide

Application Note CTAN #374

Dialogic System Release 6.0 PCI for Windows

Shearwater Research Dive Computer Software Manual

User Manual Network Interface

USB DRIVER INSTALLATION GUIDE

OPERATION MANUAL. MV-410RGB Layout Editor. Version 2.1- higher

ebus Player Quick Start Guide

Installation Notes for Outpost Network Security (ONS) version 3.2

Installation Instruction STATISTICA Enterprise Small Business

GlobalSCAPE DMZ Gateway, v1. User Guide

Installing and Configuring vcenter Multi-Hypervisor Manager

Topaz Installation Sheet

64-Bit Compatibility with Micromeritics Applications

DME-N Network Driver Installation Guide for M7CL/LS9/DSP5D

Important Notes for WinConnect Server VS Software Installation:

Intelligent Power Protector User manual extension for Microsoft Virtual architectures: Hyper-V 6.0 Manager Hyper-V Server (R1&R2)

Installation and Operation Manual Portable Device Manager, Windows version

STATISTICA VERSION 9 STATISTICA ENTERPRISE INSTALLATION INSTRUCTIONS FOR USE WITH TERMINAL SERVER

Legal Notes. Regarding Trademarks KYOCERA Document Solutions Inc.

Ethernet Interface Manual Thermal / Label Printer. Rev Metapace T-1. Metapace T-2 Metapace L-1 Metapace L-2

STATISTICA VERSION 12 STATISTICA ENTERPRISE SMALL BUSINESS INSTALLATION INSTRUCTIONS

SSD Guru. Installation and User Guide. Software Version 1.4

DME-N Network Driver Installation Guide for LS9

DeviceNet Communication Card

SmartPTT File Transfer User's Guide. Version 2.0

Maintenance Guide. Outpost Firewall 4.0. Personal Firewall Software from. Agnitum

Citrix Access Gateway Plug-in for Windows User Guide

Setup and Configuration Guide for Pathways Mobile Estimating

Networking. General networking. Networking overview. Common home network configurations. Wired network example. Wireless network examples

Features Reference. About Unified Communication System. Before Using This Machine. Starting a Meeting. What You Can Do During the Meeting

Installing the drivers for the Current Cost Data Cable

VRC 7900/8900 Avalanche Enabler User s Manual

Configuring the WT-4 for ftp (Infrastructure Mode)

SATO Network Interface Card Configuration Instructions

Software User Guide UG-461

Dell Statistica Statistica Enterprise Installation Instructions

ezvsp User's Manual ( Version 2.1d ) Sollae Systems Co., Ltd.

Contents. Hardware Configuration Uninstalling Shortcuts Black...29

ProSafe Plus Switch Utility

ScanWin Installation and Windows 7-64 bit operating system

Installing PowerLink on Windows 7 64-bit

QSG105 GETTING STARTED WITH SILICON LABS WIRELESS NETWORKING SOFTWARE

1-Port Wireless USB 2.0 Print Server Model # APSUSB201W. Quick Installation Guide. Ver. 2A

MobileStatus Server Installation and Configuration Guide

BioStar Config Guide V1.0

Network FAX Driver. Operation Guide

Installation Guide for Windows May 2016

CODESOFT Installation Scenarios

FAQ. How does the new Big Bend Backup (powered by Keepit) work?

User Guide. CTERA Agent. August 2011 Version 3.0

Plug-in Installation Instruction Xenon 1900/1902 Scanner

Guide to Installing BBL Crystal MIND on Windows 7

STATISTICA VERSION 10 STATISTICA ENTERPRISE SERVER INSTALLATION INSTRUCTIONS

Additional Requirements for ARES-G2 / RSA-G2. One Ethernet 10 Base T/100 Base TX network card required for communication with the instrument.

Copyright. Disclaimer. Introduction 1. System Requirements Installing the software 4

Dell UPS Local Node Manager USER'S GUIDE EXTENSION FOR MICROSOFT VIRTUAL ARCHITECTURES Dellups.com

ACTIVE DIRECTORY DEPLOYMENT

Step-by-Step Guide for Creating and Testing Connection Manager Profiles in a Test Lab

Troubleshooting File and Printer Sharing in Microsoft Windows XP

How To Install Sedar On A Workstation

Configuring the Beckhoff BK9000 Network Parameters

USB Driver. Installation Manual

Vodafone PC SMS (Software version 4.7.1) User Manual

IP SERIAL DEVICE SERVER

XConsole GUI setup communication manual September 2010.

End-User troubleshooting guide For Sentinel SuperPro/UltraPro and Sentinel Hardware Keys

F9 Integration Manager

Virtual CD v10. Network Management Server Manual. H+H Software GmbH

Getting Started with Vision 6

How To Configure CU*BASE Encryption

Transcription:

Application Note: JN-AN-1115 Protocol Analysis with Wireshark The tasks of commissioning a wireless network and debugging wireless network applications are often much easier to perform with the aid of a network protocol analyser. An analyser allows over-the-air packets to be captured and analysed. This Application Note describes how to configure and use the Wireshark network protocol analyser with the NXP JN5148 microcontrollers, and how to add support for the IEEE 802.15.4, JenNet, JenNet-IP, ZigBee PRO and ZigBee RF4CE protocol stacks. 1 Application Overview The network analyser system consists of a PC running Wireshark and an NXP JN5148 evaluation kit board programmed with a packet sniffer binary. The sniffer node detects (or 'sniffs') over-air packets, encapsulates them into a serial protocol and passes them to the PC via a USB-serial cable. The NXP Sniffer Server on the PC converts this serial data into UDP/IP packets, which are then interpreted by Wireshark. PC UDP/IP Wireshark Sniffer Server USB-Serial Cable NXP Sniffer Node 1.1 Compatibility The software provided with this Application Note has been tested with the JN5148-EK010 evaluation kits (any of the evaluation kit nodes can be used as a sniffer). The software is compatible with the JN514x-EK040 JenNet-IP evaluation kit, a firmware.bin file is provided for the USB dongle, other nodes may be used as sniffer nodes using a USB cable for connection with the appropriate binary for JN5148-J01 or JN5142-J01 devices. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 1

2 About Wireshark Wireshark is a network protocol analyser application. It is widely used for network troubleshooting and analysis, software and communications protocol development, and educational purposes. NXP provide dissector plug-ins to the Wireshark source code in order to add support for the following protocols:- JenNet protocol based on IEEE 802.15.4 JSNIFFER a protocol for communication with a sniffer binary running on a JN5148 or JN5139 device ZigBee RF4CE and RF4CE CERC profile Wireshark also includes support for industry-standard protocols, including:- IEEE 802.15.4 ZigBee PRO IETF 6LoWPAN (IETF RFC4944 - first published version) Wireshark user documentation and source code is available from http://www.wireshark.org/. Wireshark is an open source application and is released under the GNU General Public License version 2, available from http://www.gnu.org/copyleft/gpl.html. ZigBee protocols (PRO, RF4CE and CERC) are the intellectual property of the ZigBee Alliance (http://www.zigbee.org/). 2 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

3 Installation Procedure To install Wireshark, the associated sniffer files and the NXP plug-ins on a PC, follow the steps below: Installing Wireshark on a Windows PC. Extract the application note files to a temporary location. Install the sniffer and Wireshark plugins. Installing the sniffer server shortcuts. Remove the temporary installation files. Installing and Configuring a Loopback Adaptor. The above steps are detailed in the sub-sections below. 3.1 Installing Wireshark on a Windows PC Download and run version 1.6.5 of the Wireshark installer from the link shown below: http://wiresharkdownloads.riverbed.com/wireshark/win32/all-versions/wireshark-win32-1.6.5.exe Note 1: The Wireshark installer must be run as an administrator, i.e. right click on the executable and select Run as Administrator if necessary. Note 2: The NXP dissector plug-ins that are supplied as part of this application note only support the v1.6.x win32 releases of Wireshark. This has been updated from previous versions of this application note. Follow the installation wizard using all of the default options to install the Wireshark and WinPcap software. 3.2 Extract the application note files to a temporary location Extract the application note ZIP file to a temporary location, e.g. the desktop. 3.3 Install the sniffer and Wireshark plugins Open the extracted folder and run the Install_Jennic_Sniffer.bat file. Press any key to close the installation once it is complete. 3.4 Installing the sniffer server shortcuts 3.4.1 Windows 7/Vista Users Right click on the Install_Jennic_Sniffer_Shortcuts_Win7.bat and select Run as administrator. Press any key to close the installation once it is complete. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 3

3.4.2 Windows XP Users Protocol Analysis with Wireshark Run the Install_Jennic_Sniffer_Shortcuts_WinXP.bat file. Press any key to close the installation once it is complete. 3.5 Remove the temporary installation files Delete the extracted application note folder from the temporary location, i.e. from the desktop. 3.6 Installing and Configuring a Loopback Adaptor The sniffer uses a serial protocol to send radio packets to the PC via a USB port. This serialised data is then re-formed and forwarded on to a network adaptor to allow Wireshark to capture and dissect it. An NXP sniffer proxy server is used in conjunction with a virtual network adaptor, i.e. the Microsoft Loopback Adaptor. This section provides information on how to install and configure the Microsoft Loopback Adaptor. Note: These installation guidelines have been written for Windows 7. If running an older version of Windows please refer to Appendix A for an equivalent set of instructions. 3.6.1 Installing the Loopback Adaptor Install a Microsoft Loopback Adaptor as follows: a) Open Control Panel by following the menu path Start ->Control Panel. b) Select System and Security panel (when in category view mode). c) Select System panel b) Open Device Manager c) Click on Network adapters. 4 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

d) Open the Add Legacy Hardware wizard via the Action menu. e) Click Next at the welcome screen. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 5

f) In the The Wizard can help you install other hardware screen, select Install the hardware that I manually select from a list option and click Next. g) In the From the list below, select the type of hardware you are installing screen, select Network adaptors and then click Next. 6 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

h) In the Select Network Adaptor screen, select Microsoft and Microsoft Loopback Adaptor, then click Next. i) In the The wizard is ready to install your hardware screen, simply click Next. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 7

j) Finally, click Finish to close the wizard. 8 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

3.6.2 Configuring the Loopback Adaptor Reconfigure the Microsoft Loopback Adaptor as follows: a) Open Control Panel by following the menu path Start>Control Panel. b) Open Network and Sharing Center (via the Network and Internet menu when in category view mode). c) Open Network Connections by clicking on the Change adapter settings on the side toolbar. d) Right click on the newly installed Microsoft Loopback Adaptor, select Rename and enter Wireshark Loopback as the new name. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 9

e) Right-click on the Wireshark Loopback adaptor and select Properties. f) In the General tab of the Properties screen, select Internet Protocol Version 4 (TCP/IPv4) from the list and click Properties. 10 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

g) In the Internet Protocol Version 4 (TCP/IPv4) Properties screen, select the Use the following IP address radial button. Enter 192.168.100.1 as the IP address and 255.255.255.0 as the Subnet mask as shown below. h) Click OK to confirm the settings and close both of the properties windows. Windows should now be rebooted for the settings to take effect. Note: The loopback adaptor will not become visible in Wireshark until after Windows has been rebooted. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 11

4 Configuring a Sniffer Node Configure a sniffer node using either a JN51xx board from the evaluation kit, or an NXP USB Dongle. 4.1 Use a JN51xx Board 4.1.1 Program a JN51xx Board as a Sniffer Use the JN51xx Flash Programmer to install the appropriate NXP sniffer binary onto a JN51xxbased board. The packet sniffer captures packets and forwards them to the serial port of a PC. The serial port speed is pre-programmed into the sniffer at either 115200 bps or 1 Mbps. Select a speed supported by the PC. The binaries are located in C:\Jennic\Tools\Wireshark\Sniffer_Binaries. For a JN5148-based board, they are: JennicSniffer_JN5148_115200_250KBPS.bin (115200 bps interface, 250 kbps over-air) JennicSniffer_JN5148_1000000_250KBPS.bin (1 Mbps interface, 250 kbps over-air) For a JN5148-J01-based board, they are: JennicSniffer_JN5148J01_115200.bin (115200 bps interface, 250 kbps over-air) JennicSniffer_JN5148J01_1000000.bin (1 Mbps interface, 250 kbps over-air) For a JN5142-J01-based board, they are: JennicSniffer_JN5142J01_115200.bin (115200 bps interface, 250 kbps over-air) JennicSniffer_JN5142J01_1000000.bin (1 Mbps interface, 250 kbps over-air) firmware.bin (1 Mbps interface, 250 kbps over-air binary prepared for USB dongle) The Flash programmer is described in the JN51xx Flash Programmer User Guide (JN-UG-3007). Reset the board using the appropriate switch. Once the board has powered up, LED2 will flash steadily to indicate that the sniffer is running. You must now either close the Flash Programmer application or release the COM port and proceed to section 4.3. 4.1.2 Start the Sniffer Board Connect a JN51xx-based board programmed with the NXP sniffer binary to a PC via a USB-toserial cable. Once the board has powered up, LED2 will flash quickly to indicate that the sniffer is running. 4.2 Program a JN51xx USB Dongle as a Sniffer A firmware.bin file is provided in the SnifferBinaries directory for the JN5148J01 USB dongles provided in the EK040 JenNet-IP Evaluation kit. 12 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

4.2.1 Copy the firmware.bin file to the USB Dongle Mount the USB Dongle to the PC, it will be registered as a removable drive (called Jennic USB, a VCOM port will also be registered as NXP LPC1343 USB CDC and allocated a COM port e.g. COM30. Use command line or windows interface to delete current firmware.bin from the removable drive, then to copy this firmware.bin to the removable drive. Once copying is finished the USB dongle will reset and the LED will start to flash steadily. 4.3 Configure the ARP entry From the DOS command line add an entry for the loopback adapter to the arp table C:> arp -s 192.168.100.2 00-00-00-00-00-01 192.168.100.1 Note: this command must be run as administrator Note 2: a.bat file (add_arp.bat) containing this command is included in SnifferServer directory, which may be used to run as administrator by right clicking on it in the file manager if required. 4.4 Start the Sniffer Server Navigate to the sniffer server directory C:\Jennic\Tools\Wireshark\SnifferServer and right click on StartSniffer.exe and select Run as administrator. Note: If running the sniffer server for the first time since startup, the batch file must be run as an administrator for the packets to be visible in Wireshark. Alternately run StartSniffer.bat in the directory C:\Jennic\Tools\Wireshark\SnifferServer as administrator to add the arp table entry and start the sniffer server. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 13

The Sniffer Server is then configured as follows:- Protocol Analysis with Wireshark a) Set the 802.15.4 channel to the channel on which you want to capture packets. b) Set the optional parameters, as required: Sniffer ID can be set to a string which identifies this sniffer. This can be used when using multiple sniffers to send data to the same Wireshark capture process. The Sniffer ID string is displayed in the packet details. Set the Destination IP Address. By default, this is set to 192.168.100.2, which will result in packets being sent on the loopback adaptor configured previously. Alternatively, if set to the IP address of another PC, packets will be sent there instead. Note: Wireshark will normally look for packets on 192.168.100.1 due to the loopback. Set the Destination UDP Port used by the Sniffer Server (49999 is the default). If the default port is not used, the new UDP port number must also be set within Wireshark via the menu: Edit > Preferences>Protocols>JSNIFFER c) Select the COM port to which your sniffer s USB-serial cable is connected (note that selecting an unconnected COM port may cause the Sniffer Server to lock up). d) Set the Baud Rate used for the serial link. This must match the one of the sniffer binary downloaded to the board. e) Click the Start Server button to begin packet capture. The server should start after a few seconds. On the sniffer node, LED2 will flash faster. 14 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

5 Using Wireshark Run Wireshark from the Windows Start menu (via Start>Programs>Wireshark). Note: If the error message This application has failed to start because the application configuration is incorrect is displayed or protocol modules/dll s are not loaded on startup ( e.g. error The program can t start because MSVCR100.dll is missing from this computer ), install the Visual C++ 2010 redistributable (available http://www.microsoft.com/enus/download/default.aspx) enter Visual C++ 2010 redistributable in search box) and install either x86 or x64 dependant upon your OS version. On the home page of the Wireshark tool, under the Capture area of the page, there is a list of the available interfaces on which to sniff. Select the MS LoopBack Driver interface. Alternatively, click on Interface List under the Capture area or from the main Wireshark menu Capture>Interfaces... and then Start "MS LoopBack Driver" in the dialogue window. You should see packets begin to appear in the Wireshark window. Once the Sniffer Server has been set to the required channel and started, we recommend that it is left running and that the Wireshark Start/Stop/Restart buttons are used to control capture. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 15

Only use the Stop Server button on the Sniffer Server to stop the sniffer before restarting it on a different 802.15.4 channel. 5.1 Selecting the Protocol Wireshark will attempt to identify which protocol is running. However, to ensure that the protocol running on top of IEEE 802.15.4 is dissected correctly, Wireshark can be informed of the protocols to dissect via the Analyze>Enabled Protocols menu (see screenshot below). Note: normally enabling all protocols, then disabling protocols that interfere or overlap with the dissection of a required protocol gives the best results as lower level protocols may be required to dissect a higher layer. The relevant protocols for this sniffer application are listed and described in the table below: Protocol Description Notes 6LOWPAN 6LoWPAN protocol Enable as required (JenNet and JIP also required) IEEE 802.15.4 IEEE 802.15.4 Low-Rate WPAN Always enable JenNet JenNet v1.4 Enable as required JSNIFFER Jennic Sniffer protocol Always enable (required for Sniffer Server interface) JIP JenNet-IP protocol Required by 6LoWPAN protocol JenNet OND JenNet-IP Over Network Download Enable as required ZigBee APF ZigBee Application Framework Enable as required ZigBee APS ZigBee Application Support Layer Enable as required ZigBee NWK ZigBee Network Layer Enable as required ZigBee ZDP ZigBee Device Profile Enable as required ZigBee RF4CE ZigBee RF4CE layer Enable as required ZigBee RF4CE CERC ZigBee RF4CE CERC profile Enable as required 16 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

Note: Encryption/decryption is not supported. The encrypted payload of secure packets will be shown as raw data. 5.2 Set JSNIFFER preferences Set the JSNIFFER dissector preferences Goto Edit->Preferences->Protocols Expand the list by selecting + Find JSNIFFER and ensure all 3 boxes in the right hand panel are checked 5.3 Changing the Display Layout If the MAC addresses listed do not fit into the source and destination address fields of the packet list, you can use the Resize Columns button on the toolbar to resize the columns: You can change the panel layout to your preference in the Edit>Preferences>User Interface>Layout menu. We recommend setting the layout as shown in the screenshot below (fourth option from the left). The Wireshark layout that results from the above selection is shown in the screenshot below: JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 17

18 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

5.4 Filtering Packets If you wish to view a particular type of packet, first expand the packet s dissection tree (in the right part of the Wireshark window). Then right-click on the packet component of interest (e.g. Source field) and, from the menu which appears, select Apply as Filter>Selected. For example, if you want to view all packets captured from a certain node, expand the IEEE 802.15.4 tree, right-click on Source and select Apply as Filter>Selected (see screenshot below). JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 19

5.5 Colouring Packets Protocol Analysis with Wireshark Colouring rules may be applied to the dissected packets. Refer to the Wireshark documentation (http://wiki.wireshark.org/coloringrules) for guidance on applying colouring rules. Example colouring rules are provided for JenNet and ZigBee in the ZIP file of this Application Note. To import these colouring rules, follow the instructions below: 1. In Wireshark, follow the menu path View>Coloring Rules. 2. Select all the currently listed filters and click Delete (if you wish to preserve existing colouring rules then omit this step). 3. Import one of the following text files, depending on your chosen protocol: Jennic/Tools/Wireshark/Example_JenNet_colours.txt or Jennic/Tools/Wireshark/Example_Zigbee_colours.txt 4. Select all filters and click Apply. 5. Ensure that the option View>Colorize Packet List is ticked. Note: The colouring rules are applied in order. Therefore, custom rules should be above 'UDP' in the list. 20 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

6 Uninstalling Wireshark Wireshark may be uninstalled via the Add or remove programs in the Windows Control Panel. Note: By default, the Personal settings (e.g. JenNet) will not be removed. To uninstall these settings, ensure that the Remove personal settings and WinPcap checkboxes are selected. Complete instructions are provided in the User Guide available at http://www.wireshark.org/. 7 ZigBee PRO Network Layer Packet Decryption Versions of Wireshark (v1.4.2 and above) support the decryption of ZigBee network packets. To decrypt the traffic, follow the menu path Edit>Preferences>Protocols>ZigBee NWK and enter the following, as for the HomeEnergyMonitorPaging demo: Security Level: AES-128 Encryption, 32-bit Integrity Protection Network Key: See below Trust Center Address: 00:00:00:00:00:00:00:02 Trust Center Link Key: 00:EE:DD:CC:BB:AA:99:88:77:66:55:44:33:22:11:FF (Note the keys are in reverse byte order) Press Apply. The ZigBee Transport Key packet can now be decrypted which will reveal the Network key that you can copy and paste into the Network Key field above. Click Apply again and the network layer will now be decrypted. 8 RF4CE Protocol analysis The ZigBee RF4CE protocol uses 3 channels for a channel hopping mechanism to avoid interference. Wireshark may be configured to simultaneously collect data from 3 sniffers and collate the captured data into a single capture. Each sniffer should be connected to the host PC via separate serial cables as described above. Start the sniffer server specifying the following for each of the 3 sniffers: A separate channel from the channels 15, 20 and 25 A different sniffer ID (e.g. Channel15) The sniffer capture is then started within Wireshark using the Loopback Adapter entry, as previously described. Note: When RF4CE devices perform pairing, security keys are transmitted. These are sent at a very low power and the sniffers must be located within range to receive these. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 21

9 Troubleshooting 9.1 Sniffer Board Once the sniffer board is programmed and powered on, LED2 on the board will flash at about 2 Hz to indicate that it is idle. If this does not happen, ensure that the module is programmed with the correct binary and is powered on. 9.2 Sniffer Control The sniffer is controlled via serial packets from the Sniffer Server. When you click Start Server, after a few seconds LED2 will start to flash faster, at about 5 Hz to indicate that it is capturing. If this does not happen, check that the USB-serial cable is connected correctly and that you have chosen the right COM port number for that cable. Starting the Sniffer Server on an unconnected COM Port may cause the Sniffer Server to lock up. 9.3 Wireshark If Wireshark fails to run after you have installed it, ensure that you have the Visual C++ 2010 redistributable installed. 9.4 Missing Packets The packet sniffer will only decode packets that are received by the sniffer node. Therefore, ensure that the sniffer node is located within reception range of packets and nodes of interest. In addition, in a busy network environment, the processing speed of the sniffer node and connection to the PC may limit the number of packets that can be analysed. 9.5 Windows Hangs / Blue Screens Due to an interaction between WinPCAP (part of Wireshark) and the Kerio Personal Firewall, Windows XP may hang or crash. This is caused by the file fwdrv.sys in the Kerio installation. To avoid this, disable Kerio or replace it with an alternative firewall. 9.6 Windows 7 and Vista No Packets Received The Microsoft Loopback adaptor for Windows Vista and Windows 7 requires a MAC address to be set for the loopback adaptor. A dummy address may be set using arp s 192.168.100.2 00-00-00-00-00-01. This is set using the StartSnifferServer.bat script. Check that an entry has been added using arp a. On some systems administrator permission must be given separately to add the arp entry, and then to start the sniffer server, here the batch file add_arp.bat is run as administrator, followed by also running the SnifferServer.exe as administrator. 22 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

Appendix A - Installing on previous versions of Windows This appendix provides information on how to install and configure the loopback adaptor on Windows XP and Vista. Installing the Microsoft Loopback Adaptor a) Open Control Panel by following the menu path Start>Settings>Control Panel in Windows XP or Start> Control Panel in Windows Vista. b) Open the Add Hardware Wizard. Note: You may need to change the folder view to access the Add hardware option. In the Control panel window, select Tools->Folder Options in the menu bar. In the general tab, under the Tasks section, select Use Windows classic folders and click OK. c) Click next at the welcome screen to begin the wizard. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 23

d) In the Is the hardware connected? screen, select Yes, I have already connected the hardware and click Next. e) In the The following hardware is already installed on your computer screen, select Add a new hardware device and then click Next. 24 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

f) In the The Wizard can help you install other hardware screen, select Install the hardware... option and click Next. g) In the From the list below, select the type of hardware you are installing screen, select Network adaptors and then click Next. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 25

h) In the Select Network Adaptor screen, select Microsoft and Microsoft Loopback Adaptor, then click Next. i) In the The wizard is ready to install your hardware screen, simply click Next. 26 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

j) Finally, click Finish to close the wizard. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 27

Configuring the Microsoft Loopback Adaptor Reconfigure the Microsoft Loopback Adaptor as follows: Protocol Analysis with Wireshark a) Open Control Panel by following the menu path in Start>Settings>Control Panel Windows XP or Start>Control Panel in Windows Vista. b) Open Network Connections. Note: Network Connections is access via the Network and Sharing Center in Windows Vista. c) Right click on the newly installed Microsoft Loopback Adaptor, select Rename and enter Wireshark Loopback as the new name. 28 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

d) Right-click on the Wireshark Loopback adaptor and select Properties. e) In the General tab of the Properties screen, select Internet (TCP/IP) (or Internet Protocol Version 4 (TCP/IPv4) for Windows Vista) from the list and click Properties. JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 29

g) In the Internet Protocol (TCP/IP) Properties screen, select the Use the following IP address radial button. Enter 192.168.100.1 as the IP address and 255.255.255.0 as the Subnet mask as shown below. h) Click OK to confirm the settings and close both of the properties windows. Windows should now be rebooted for the settings to take effect. Note: The loopback adaptor will not become visible in Wireshark until after Windows has been rebooted. 30 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

Revision History Version Notes 1.1 First public release 2.0 Dissectors migrated to plug-in architecture 2.1 Dissectors for ZigBee RF4CE and ZigBee RF4CE CERC added, IETF 6LoWPAN removed, as now included in standard Wireshark build Wireshark plug-ins updated to support Wireshark v1.4.1 2.2 Decryption of ZigBee PRO Smart Energy packets added Packet Colours files updated to also support Wireshark v1.4.2 2.3 Windows 7 installation instructions added 2.4 JenNet-IP dissectors added JN5148-J01 sniffer binaries added 2.5 Added JN5142-J01 sniffer binaries USB dongle instructions added 2.6 Added firmware.bin for JN5148-J01 USB dongle JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 31

32 NXP Laboratories UK 2012 JN-AN-1115 (v2.6) 24-Jul-2012

Important Notice Jennic reserves the right to make corrections, modifications, enhancements, improvements and other changes to its products and services at any time, and to discontinue any product or service without notice. Customers should obtain the latest relevant information before placing orders, and should verify that such information is current and complete. All products are sold subject to Jennic s terms and conditions of sale, supplied at the time of order acknowledgment. Information relating to device applications, and the like, is intended as suggestion only and may be superseded by updates. It is the customer s responsibility to ensure that their application meets their own specifications. Jennic makes no representation and gives no warranty relating to advice, support or customer product design. Jennic assumes no responsibility or liability for the use of any of its products, conveys no license or title under any patent, copyright or mask work rights to these products, and makes no representations or warranties that these products are free from patent, copyright or mask work infringement, unless otherwise specified. Jennic products are not intended for use in life support systems/appliances or any systems where product malfunction can reasonably be expected to result in personal injury, death, severe property damage or environmental damage. Jennic customers using or selling Jennic products for use in such applications do so at their own risk and agree to fully indemnify Jennic for any damages resulting from such use. All trademarks are the property of their respective owners. NXP Laboratories UK Ltd (Formerly Jennic Ltd) Furnival Street Sheffield S1 4QT United Kingdom Tel: +44 (0)114 281 2655 Fax: +44 (0)114 281 2951 E-mail: info@jennic.com For the contact details of your local Jennic office or distributor, refer to the Jennic web site: www.nxp.com/jennic JN-AN-1115 (v2.6) 24-Jul-2012 NXP Laboratories UK 2012 33