How to configure sniffer for 802.15.4

1. Introduction

The 802.15.4 sniffer allows the user to detect and record 802.15.4 packets, including Zigbee® and Thread protocols, transmitted between devices in the vicinity of the sniffer device. The captured packets are logged and presented in a readable format using Wireshark, which is a free external software tool.

2. Downloading and installing the package

Download the latest version of STM32CubeMonRf. Extract the archive and install the application (this may require administrator rights).

Before launching the application and using the 802.15.4 sniffer, ensure the following tools are installed:

  • Wireshark version 4.0.4 or higher
  • Wireshark extension (refer to Adding the Wireshark extension below)
  • Python, version 2.7.x or 3.8 and higher
  • PySerial, version 1.5 (Python library)
  • Hardware programmed with the relevant binaries (refer to Programming the board below)
Connectivity get cubeRF.jpg

3. Adding the Wireshark extension

C:\Program Files\STMicroelectronics\STM32CubeMonitor-RF\sniffer (default path) contains the following two files:

  • stm32cubeMonRf_sniffer.py
  • stm32cubeMonRf_sniffer.bat

Copy these files and paste them in the Wireshark extcap directory.

To find the Wireshark extcap directory, open Wireshark, go to Help -> About Wireshark -> Folders -> Personal Extcap path (click on the link).

Connectivity find extcap on Wireshark.jpg

4. Programming the board

Two types of STM32WB55 boards can be used:

  • Dongle: P-NUCLEO-WB55
  • Nucleo: NUCLEO-WB55RG


Connectivity STM32WB55 Nucleo Dongle.jpg


The wireless stack is in the \Projects\STM32WB_Copro_Wireless_Binaries\STM32WB5x\stm32wb5x_Mac_802_15_4_fw.bin folder. The firmware binaries are Mac_802_15_4_Sniffer_Dongle.bin and Mac_802_15_4_Sniffer_Nucleo.bin. The location changes with the operating system:

  • For Windows, the firmware is in the <Public documents>\STMicroelectronics\STM32CubeMonitor-RF\sniffer folder, that is C:\Users\Public\Documents\STMicroelectronics\STM32CubeMonitor-RF\firmwares.
  • For Linux, the firmware is in the <userhome>/STMicroelectronics/STM32CubeMonitor-RF/sniffer folder.
  • For macOS, the firmware is in the document folder provided in the setup package: \Users\Public\Documents\STMicroelectronics\STM32CubeMonitor-RF\firmwares\Mac_802_15_4_Sniffer.bin.

Use STM32CubeProgrammer to program the board with the binaries:

  • For M0, use STM32WB_Copro_Wireless_Binaries\STM32WB5x\stm32wb5x_Mac_802_15_4_fw.bin (address is in the Copro manual).
  • For M4, use Mac_802_15_4_Sniffer_Nucleo.bin for the Nucleo board, or Mac_802_15_4_Sniffer_Dongle.bin for the dongle (address 0x0800 0000).

For more details, refer to the Copro manual.

5. Using STM32CubeMonitorRF

Open STM32CubeMonitorRF and click on the 802.15.4 sniffer. When Wireshark opens, click on the STM32CubeMonitorRF 802.15.4 sniffer.

Connectivity Wireshark general menu.jpg

To change the channel, click on the gear icon. This opens a new window, which lets the user select a channel (between 11 and 26).

Connectivity Wireshark channel menu.jpg

After finishing the configuration, double click on the STM32CubeMonitorRF 802.15.4 sniffer to open a new window, displaying all frames.

6. Tips

Sniff multiple channels: the number of sniffers must equal the number of channel sniffers.

  1. Configure the sniffers with the desired channels and click on the gear icon.
  2. Select the sniffers -> right click -> select Start capture:

    Connectivity multiple sniffer step2.jpg
  3. Add a new channel column:

    Connectivity multiple sniffer step3.jpg
  4. Multiple channels are now configured:

    Connectivity multiple sniffer step4.jpg