Sniffing nRF24L01+ Traffic with Wireshark

Wireshark trace

We’re sure that some of our readers are familiar with the difficult task that debugging/sniffing nRF24L01+ communications can be. Well, [Ivo] developed a sniffing platform based on an Arduino Uno, a single nRF24L01+ module and a computer running the popular network protocol analyzer Wireshark (part1, part2, part3 of his write-up).

As these very cheap modules don’t include a promiscuous mode to listen to all frames being sent on a particular channel, [Ivo] uses for his application a variation of [Travis Goodspeed]‘s technique to sniff Enhance Shockburst messages. In short, it consists in setting a shorter than usual address, setting a fix payload length and deactivating the CRC feature. The Arduino Uno connected to the nRF24L01+ is therefore in charge of forwarding the sniffed frames to the computer. An application that [Ivo] wrote parses the received data and forwards it to wireshark, on which can be set various filters to only display the information you’re interested in.

Comments

  1. Tobias says:

    Ohhh. This is SWEET!
    Looks great. I will take a closer look at that this evening.

  2. sparerobot says:

    I just got these modules so this couldn’t come at a better time.

  3. Ribster says:

    This is pretty nice. I’ve looked at the option of a RTL-SDR combined with a LO, but this is much cheaper and quite apparent. It already talks in the 2.4Ghz range, so why use something else..
    Big up!

  4. Bogdan says:

    THis is really great work! I wonder if there is any module out there who might give access to the raw demodulated data…

  5. matseng says:

    Nice hack! I’ll definitely try this when I get back home to my lab.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 96,357 other followers