How to configure sniffer for 802.15.4

1. How to configure sniffer for 802.15.4

1.1. Introduction

The 802.15.4 sniffer allows the user to detect and record 802.15.4 packets, including Zigbee® and Thread protocols, transmitted between devices in the vicinity of the sniffer device. The captured packets are logged and presented in a readable format using Wireshark, which is a free external software tool.

1.2. Download and install the package

Download the latest version of STM32CubeMonRf. Extract the archive and install the application (this may require administrator rights).

Before launching the application and using the 802.15.4 sniffer, you must have:

  • Wireshark version 4.0.4 or higher
  • Wireshark extension (refer to the section Add the Wireshark extension below)
  • Python, version 2.7.x
  • PySerial, version 1.5 (Python library)
  • Hardware flashed with the binaries (refer to the section How to flash the board below)
Connectivity get cubeRF.jpg

1.3. Add the Wireshark extension

In C:\Program Files\STMicroelectronics\STM32CubeMonitor-RF\sniffer (default path), you can find two files:

  • stm32cubeMonRf_sniffer.py
  • stm32cubeMonRf_sniffer.bat


Copy these files and paste in the Wireshark extcap directory.

To find the Wireshark extcap directory, open Wireshark, go to Help -> About Wireshark -> Folders -> Personal Extcap path (click on the link).

Connectivity find extcap on Wireshark.jpg

1.4. How to flash the board

You can use two types of STM32WB55:

  • Dongle: P-NUCLEO-WB55
  • Nucleo: NUCLEO-WB55RG
Connectivity STM32WB55 Nucleo Dongle.jpg


The wireless stack is in the \Projects\STM32WB_Copro_Wireless_Binaries\STM32WB5x\stm32wb5x_Mac_802_15_4_fw.bin folder. The firmware binaries are Mac_802_15_4_Sniffer_Dongle.bin and Mac_802_15_4_Sniffer_Nucleo.bin. The location changes with the operating system.

  • a) For Windows, the firmware is in the <Public documents>\STMicroelectronics\STM32CubeMonitor-RF\sniffer folder, that is C:\Users\Public\Documents\STMicroelectronics\ STM32CubeMonitor-RF\firmwares.
  • b) For Linux, the firmware is in the <userhome>/STMicroelectronics/STM32CubeMonitor-RF/sniffer folder.
  • c) For macOS®, the firmware is in the document folder provided in the setup package \Users\Public\Documents\STMicroelectronics\STM32CubeMonitor-RF\firmwares\Mac_802_15_4_Sniffer.bin

Use STM32CubeProgrammer to flash the board. There are two binaries to flash:

  • For M0, use the STM32WB_Copro_Wireless_Binaries\STM32WB5x\stm32wb5x_Mac_802_15_4_fw.bin (address is in the Copro manual).
  • For M4, use the Mac_802_15_4_Sniffer_Nucleo.bin for nucleo and Mac_802_15_4_Sniffer_Dongle.bin for dongle (address 0x08000000).

For questions, you can find all information in the Copro manuel.

1.5. Use STM32CubeMonitorRF

Open the STM32CubeMonitorRF, click on the 802.15.4 sniffer. When Wireshark opens, click on STM32CubeMonitorRF 802.15.4 sniffer.

Connectivity Wireshark general menu.jpg

To change the channel, click on the gear icon. This opens a new window where you can select your channel (between 11 and 26).

Connectivity Wireshark channel menu.jpg

When you have finished the configuration, double click on STM32CubeMonitorRF 802.15.4 sniffer to open a new window which displays all frames.

1.6. Tips

Sniff multiple channels: the number of sniffers must equal the number of channel sniffers.

  • First step: Configure the sniffers with the desired channels, and click on the gear icon.
  • Second step: Select sniffers, right click -> select Start capture:
Connectivity multiple sniffer step2.jpg
  • Third step: Then add a new channel column:
Connectivity multiple sniffer step3.jpg
  • Fourth step: Now you have two or more channels:
Connectivity multiple sniffer step4.jpg