Zniffer File HowTo

DrZWave

Z-Wave developers have a handy tool for debugging firmware and Z-Wave network issues called the Zniffer. The Zniffer consists of two parts, the first is a USB dongle with special firmware and the second is the Windows program. You can’t buy just a Zniffer USB dongle (they come as part of some of the developers kits) but you can make one out of a standard UZB. You can even make a SuperZniffer as described in my previous blog posting. The Zniffer program is included in the Simplicity Studio IDE tools for developing Z-Wave products.

Zniffer traces are INVALUABLE when submiting a support case to the Silicon Labs Z-Wave support web site. I am an Field Applications Engineer so I often review Zniffer traces captured by developers who have questions or are reporting bugs. The problem is that many times I get a support case that says “Zniffer trace attached – what is problem?” and the Zniffer trace is several hundred megabytes with dozens of Z-Wave networks and maybe one hundred Z-Wave nodes captured across days of time. Talk about the proverbial needle in a haystack! So I am asking everyone to follow a few rules BEFORE attaching a Zniffer trace to a support case.

Zniffer File Rules

Before attaching a Zniffer file for Z-Wave support to review, include the following:

  1. The HomeID of the network with the problem
  2. The NodeID of the Z-Wave node that demonstrates the problem
  3. The line number or the date/time of the where the problem occurred (or a range)
  4. The Security Keys of the Z-Wave network
  5. A clear and concise description of the problem, what should have happened, what didn’t happen, what you believe is wrong

ZnifferHowTo1

HomeID

The HomeID of a Z-Wave network is a 4 byte, eight digit hexadecimal number that uniquely identifies a single Z-Wave network. Only devices with the same HomeID can talk to each other. In a development environment there are often dozens or even hundreds of Z-Wave networks in range. Remember the Zniffer captures every network in the air. Please do not filter the HomeID when saving out the Zniffer file as there may be critical interactions with other network or even noise that will be filtered out if you save only the matching HomeID. We can always filter by HomeID when displaying the network on our PC but we can’t see the data if its not in the file.

NodeID

The NodeID of the node that is displaying the issue has to be identified. You might have dozens of nodes in the network who are all talking at once so we need to know which one is the one with the problem. Please include details of the device as well such as what type it is (binary switch, thermostat, sensor, battery powered, etc) . Ideally if you can include the device within the zniffer file that will tell us just about everything we need to know as the NIF will be exchanged and the interview will take place.

Date/Time

Each transaction in the Zniffer trace is identified by a line number on the left side or the date/time. Indicating the line number or date/time or a range of these will help us navigate the potentially huge Zniffer file and quickly zoom in on the problem. Wading thru days of Zniffer data to finally find the interesting bit is just wasting our time and yours.

Security Keys

If you are working with Secure devices you MUST include the security keys. Without the security keys the data is encrypted and it is all just meaningless ones and zeroes and we can’t help you. Now that all devices are required to be secure, the key file is critical. The Zniffer trace has to include the SPAN table update as without the SPAN table we again cannot decrypt the message. The easiest way to be sure the SPAN is included is to add the device-under-test (DUT) to the network while capturing the Zniffer trace. The other option is to power cycle the DUT which will usually cause the DUT and the controller to exchange Nonces to resynchronize the SPAN table and we can once again decrypt the messages in the Zniffer.

To extract the security keys, join the PC Controller to the Z-Wave network. Be sure to enable all levels of security by providing the S2 DSK of the PC Controller. Once joined to the network, the keys can be saved to a file using the procedure below:

ZnifferHowTo2

The filename is the HomeID.txt which in the case above is FFE5B5C9.txt and contains:

9F;C592557B5F99DDC9BDD12D0D926BAFE5;1
9F;31944FE8F8DE2330E79741313A949190;1
9F;18FD847446AFD7E410B2BCF8912BC632;1
98;C65D55C44FB2156635CA07A48D362AD3;1

To decyrpt the messages in the Zniffer, just click on Load Keys and enter the directory for the file. Then all the messages are decrypted and we can help you solve your problem.

19 thoughts on “Zniffer File HowTo”

  1. staze January 11, 2020 / 8:50 pm

    Hi there. I’m trying to troubleshoot a z-wave issue (lock talking to hubitat), and I can’t get the security keys to actually work. I’ve got two zwave sticks, one standard for use with Zwave Controller. One flashed to Zniffer. Extracting the security keys using PC Controller using standard Zwave stick doesn’t allow decryption of packets in Zniffer, which I’m guessing is because the DSK for the two keys is different? Maybe I’m not understanding the process well enough.

    I don’t seem to have any way to join Zniffer to my mesh, and I don’t think that’s needed. I’m just not sure how to proceed. This post is the best info I’ve found for doing any of this.

    Thanks!

    Like

    Reply
    • DrZWave January 11, 2020 / 9:24 pm

      Use the PC Controller to join the network. Then click on the shield icon in the upper right corner, then click on SAVE. The keys will be stored into a text file which the name of the file is HomeID.txt (The HomeID is an 8 hex digit number). The Zniffer does not join the network, it just uses the keys from the PC Controller.
      Once the keys are saved (best place is on your desktop as that is the default place the Zniffer will work), then you can click on an encrypted frame and then Load Keys. The frame should be decrypted. If it is not, then you may not have the SPAN table in the capture. The easiest way to make sure to get the SPAN table is to power cycle the device you are working with. Usually it will negotiate a new SPAN when powered up and if the Zniffer is running it will capture it. Once captured, the zniffer should decrypt all the frames.
      Note that the diffe-Helman key exchange cannot be decrypted but you should not need to do that anyway.
      Make sure you have the latest version of both PC controller and Zniffer which are now released thru Simplicity Studio and not on the web. There was a version of the Zniffer earlier in 2019 that could not decrypt routed frames.

      Like

      Reply
      • staze January 11, 2020 / 11:03 pm

        Okay, I think I’m still missing something.

        Do I only need the one zwave usb stick (the zniffer) or a second one? If I just have the zniffer connected when I launch PC Controller, it won’t let me click the shield to save out the keys. But if I have my other zwave stick plugged in, that’s joined to the network, it can save out the keys. But, those keys don’t seem to work to decrypt traffic.

        I am using the versions through Simplicity Studio.

        What does the SPAN table look like (will it be in the trace)? Maybe I’m trying to decrypt that… The lock just shows transmitting “Security Nonce Get” packets, and “Security Message Encapsulation Message”, and these are the ones that don’t decrypt with the keys I got from the other stick.

        Happy to provide a trace and all if that would help figure out what the heck is going on. Clearly missing one step. Maybe my Zniffer stick has an old firmware (that was hard to find, and seems to say it’s version 2.55).

        Like

  2. staze January 11, 2020 / 11:19 pm

    If it helps, DUT is non-Zwave Plus (Schlage BE469). Not sure if that alters the process for decryption.

    Like

    Reply
  3. DrZWave January 12, 2020 / 12:01 am

    The schlage lock is S0 so there are no SPAN tables as each frame requires its own Nonce Get/ Nonce Report. SPAN tables are only for Security S2.

    One UZB with the standard Static Controller (or bridge) library is needed for the PC Controller.
    The other UZB with the Zniffer firmware is needed for the Zniffer.

    You have to select the correct COM port for each program. The Zniffer will search for Zniffer firmware “Capture->Detect Zniffer Modules”. The PC controller isn’t as good at looking for the correct COM port. You have to choose the right one for it.

    If you’re getting Nonce GET frames then the zniffer must be working.
    For S0 you can also just copy the S0 key out of the PC Controller and paste it into the Decrypt Message box.

    Liked by 1 person

    Reply
    • staze January 12, 2020 / 12:09 am

      Yeah, then something is broken/not working. If I give it (Zniffer) the S0 key (straight out of PC Controller) it just says “Incorrect Key”. It’s seeing plenty of traffic. So Zniffer is working. I just seem to have a wrong S0 Key. But each program works. I even tried keeping both running and that didn’t seem to make a difference either. =/ Anything else that could be it or that I may be missing?

      Like

      Reply
      • staze January 12, 2020 / 11:59 pm

        Could it be that the secondary controller isn’t having the proper keys shared with it (maybe it’s doing an insecure join), and therefore doesn’t have the proper keys to decrypt the traffic?

        Like

  4. DrZWave January 13, 2020 / 12:10 am

    Anything is possible…
    You will know if the PC Controller is joined if all the devices show up in it. You should be able to control the lock from the PC Controller.

    Like

    Reply
    • staze January 13, 2020 / 12:18 am

      Hmm… I see on/off commands, but not sure “lock” and “unlock” correspond to that. Would I have to send a custom command to the lock?

      Like

      Reply
      • DrZWave January 13, 2020 / 2:00 am

        The PC Controller can send any command class command. Click on the DUT and then the {…} icon and then select DoorLock CC.

        Liked by 1 person

      • staze January 13, 2020 / 2:11 am

        hmm… clicked {…}. Then “select”, under Command_Class_Door_lock ver.1 (had to have it show all commands), I say “door lock operation set” then “Door_Unsecured” or “Door_Secured”. Then send? I tried a “Get” and “Report” and I don’t see how to show the resulting response. The set did nothing. =/ I’ll have to look at documentation some more…

        Like

  5. Demetrianos January 21, 2020 / 10:47 am

    Hello! I am having trouble with the z-wave zniffer tool. I have included my aeotec z-wave stick as a secondary controller to my smartthings hub and PC Controller seems to work fine. However, zniffer tool does not work properly. When I hit the “Capture->Detect Zniffer Modules” nothing appears on the screen. It says “Detect” but it does not detect anything. I am using the latest versions through Simplicity Studio.

    Like

    Reply
  6. Andreas February 2, 2022 / 12:36 pm

    Hi, is there a way to convert zlf files to csv format or get CSV format directly from Zniffer? I would like to optimize the network more in general and use some dashboarding / analytics tools to analyze e.g. 1 hour of sniffing: What are the top talkers? How many hops are used from the nodes to the controller? What are the core routing nodes in the network?
    I want to use this information to a) detect misconfigured noes sending out unnecessary packets and b) get an indication how to best optimize routing (e.g. via APRs).

    Like

    Reply
  7. YohanD February 7, 2024 / 6:20 pm

    Hi, I have been playing around with Z-wave a bit. I’m using a UZB-7 with the Zwave PC controller which comes with Simplicity studio, I have setup a zniffer using a wstk board. I have a custom node with the EFR32ZG23 chip. The UZB-7 and the custom board connect with each other and communicate with each other. However, in the Zniffer software I see only traffic from the node(Id 2) to the pc controller (Id 1) and not the other way around. The same goes with messages originating from the node to the pc controller. You can see the messages that the node is sending but not the ACK messages from the Pc controller. There are no filters enabled.

    Also, I am not able to decrypt any S2 encapsulated messages. I have followed all the steps for decryption correctly. I have reset SPAN so that the NONCE message is seen by the zniffer, I have also let the zniffer record from the start of the inclusion processs several times. But however when i try to decrypt any message I always get a message saying the decryption key is incorrect. The key is taken from the PC controller. I have also gone with saving the keys in a folder form the PC controller and doing a load keys from the zniffer app. But I still get a message that the key is incorrect. I have verified that Home ID in the pc controller and the zniffer is the same. What could be the reason for this?

    Also, Is there a way where you can see the decrypted message from the PC controller log in a better way than it is seen in the attached image. Maybe some sort of UI which tells us what each byte in the decoded/decrypted message is?

    I can attach images and log files for these issues. But I can’t seem to upload them here. Is there a better place to ask this question?

    Like

    Reply
    • DrZWave February 7, 2024 / 7:23 pm

      I can’t really say what your problems are and this forum isn’t able to attach files/images. Use the Silabs community pages: https://community.silabs.com.

      Sounds like you’re doing all the right things. Try View->Frame Details->Enable and View->All Frame Types.

      The zniffer will display what each byte of the message means in various versions of the Command Class in the bottom pane as shown here: https://drzwave.files.wordpress.com/2019/05/znifferhowto1.png

      Like

      Reply
      • yohandsouza444804521b February 8, 2024 / 3:05 pm

        Hi, Thanks for replying.
        ” Try View->Frame Details->Enable and View->All Frame Types.” both these options are already enabled.

        “The zniffer will display what each byte of the message means in various versions of the Command Class in the bottom pane as shown here:” Yes, I’m aware of this, I just wanted to know if this can be done in the PC controller itself.

        Like

      • DrZWave February 12, 2024 / 11:19 am

        No, Only the Zniffer will decode the frame. The PCC can display a log of the hex files but not decode it for you.

        Like

Leave a comment