However, this still shows all DTLS traffic which may be more than required. While it reduces the trace significantly, a lot of irrelevant traffic remains. In the “display filters” field in Wireshark. The trace can easily be filtered down by entering: It is known whether the Z/IP client is using IPv4 or IPv6 The IPv6 prefix of the Z-Wave nodes is known (typically fd00:bbbb::)

The IPv6 of Z/IP Gateway itself is known (typically fd00:aaaa::3) uses UDP port 41230 and unencrypted uses UDP port 4123 The traffic can be filtered, based on the properties of the Z/IP frames: Wireshark allows for extensive filtering of data, to filter out irrelevant data in a long trace. To keep the amount of data manageable some filters must be applied. This is because all the broadcast traffic received on the Ethernet interface is also forwarded to the network bridge, and hence tap0. On the initial screen, double click the “tap0” interface to start capturing traffic:Īs the tap interface is bridged through br-lan to the Ethernet interface, a lot of traffic will be captured, while none of it is relevant.

Capture First Packets #įrom the Raspberry Pi start menu, select “Internet” and “Wireshark”. Next, log out of the Raspberry Pi from the start menu and log in again to activate the changes made to user groups. By default, not all users are allowed to capture traffic, so the current user needs to be added to the Wireshark group: Installing Wireshark for Packet Capture #Įnable non-root users to capture packets when prompted. Participants should be familiar with connecting to the Raspberry Pi. Hardware Requirements #ġ Z-Wave Radio Development Board: ZGM130S SiP Moduleįamiliarize yourself with the protocol by referring to the following items:įurther, the participants should have completed This exercise demonstrates how to capture traffic on the IP interface decrypt the traffic and parse the payload. In it, you will learn how to do the following: This exercise is the fourth exercise in the ‘Z-Wave Controller Training Course’ series. This lab exercise explores how to capture and analyze Z/IP frames over IP using the Wireshark tool

Wireshark traffic analysis