SmartRF™ Packet Sniffer User Manual..
Contents
1. Source PAN Dest PAH Ox F FFF Display filter Address Ox6060 Address Ox 0001 Address Ox FFFF Source Address Ox au Dest Address Ox FFFF Time line Address Ox0006 Source Address 0 0000 SWRU187D 2 gt Figure 11 Packet sniffer screenshot from IEEE8022 15 4 ZigBee protocols 11 30 Texas SWRU187D NSTRUMENTS 2 3 Menus and Toolbars Menu Button Key Description File Reset Empties the packet buffer and the packet list File Open data Load packet buffer from file File Save data Save packet buffer to file ka Display the tabs at the bottom of the window Start the packet sniffer does not empty the 4 F5 buffer il F6 Pause the packet sniffer Delete all captured packets when starting Switch automatic scrolling on off owitch between normal font or small font in the ob packet view window Settings gt Cash buffer size The size of the packet RAM buffer in megabytes A clock multiplier which allows you to Settings gt compensate for clock speed differences on the Clock multiplier connected device and the hardware running the network application Help on the file format used to save data About the PSD file format Help User Manual Opens this document in your PDF file viewer Help Rev History Revision history bug fixes new features etc The application is closed by double clicking in the2. Ox00 Frequency Synthesizer Contre OxO00D Ox21 Frequency Control Word Control Word Midc OxO00F 6 Control Word Low Configuration 0x23 Configuration 0 1 23 Configuration m TAB i QU Ox0013 0x22 Modem Configuration Ox0014 O0xFS Modem Configuration Ox0004 0x00 Charnnel Number Registers 3 4 lt 3 nx m ROSE LALEIIR D oe 3 EIS 0 15 Deviation Setting nx nzl x5e6 Front End Configuration Ox0022 0x10 Front End TH Configuration Footer x nls xlS Main Radio Control State Mac OxO019 0x16 Frequency Offset Compensatic OxO01lA Ox 6C Bit Synchronization Conficni Control Templates 20 AGC Control 01 0 91 Control 0 Synthesizer Calib Packet sniffer settings m qu Y 3 3 651 SFR definitions html Packet sniffer settings Export to File RF settings Soc i RF settings struct typedef RF settings Copy to Clipboard Figure 19 SmartRF Studio Code Export Header Select Packet sniffer settings The register settings with correct formatting can be seen in the Preview tab to the right Select Export to file to save the settings to file 25 30 Texas
3. 6 INSTRUMENTS SmartRF Packet Sniffer User Manua 2 Texas Instruments SmartRF Packet Sniffer IEEE 802 15 4 MAC and ZigBee 2006 File Settings Help 182 ZigBee 2006 Frame control field RSSI FCS Type Sec Pnd Ack req PAN compr dBm ACK 0 0 0 0 74 OK Frame control field Sequence Source Type Sec Pnd Ack req PAN compr number Address DATA 0 0 1 1 0 21 0 6060 0 0006 Frame control field Sequence Type Sec Pnd Ack req compr number 0 0 0 0 0 21 Frame control field Sequence Type Sec Pnd Ack req compr number DATA 0 0 1 1 OxCF 0 0000 Frame control field Sequence Type Sec Pnd Ack req compr number 0 0 0 0 OxCF Frame control field Sequence Dest Dest Type Sec Pnd Ack req PAN compr number PAN Address CMD 0 0 0 0 OxFFFF OxFFFF Frame control field Sequence Source Source Type Sec Pnd Ack req PAN compr number PAH Address BCN 0 0 0 0 0x79 0 0000 Frame control field Sequence Dest Dest Type Sec Pnd Ack req compr number Address CMD 0 0 0 0 OxFFFF OxFFFF Capturing device Radio Configuration Select fields Packet details Address book Display filter Time line SOURCE lt 148 270 gt Unregistered broadcast 888 E EEE Auto registered 0 Auto registered 1 Auto registered 2 Auto reg
4. 2 06 Select fields The field selection tab can be used to select which fields to display and which to hide in the packet list This feature is particularly useful for low resolution screens less than 1024x768 The fields are grouped in several colour coded categories The time stamp can be displayed in microseconds or milliseconds The payload data can be displayed as hex bytes or as plain text In plain text format all non printable characters will be replaced by a The Selected Fields list box gives the possibility to select predefined field groups It is also possible to select all or none Each frame be shown either with its LQI Link Quality Indication ranging from 0x00 to OxFF or RSSI Received Signal Strength Indicator with an approximation to the actual RF level in dBm The parameter is derived from the IEEE802 15 4 ZigBee protocol specification The exact definition will depend on the used protocol The example below shows the fields defined for the SimpliciTI protocol Capturing device Radio Configuration Select fields Facket details Address book Display filter Time LJ Packet Header Simplicity Header App Payload Network App Footer Time stamp us Miscellanious Application payload Ping Length byte Dest address Link client 3 source address Link Server Port Join client 1 Device Into Join server Transaction ld Security security header Frequency Frequen
5. and the filter conditions are given on the following lines In this example the filter condition is Dest Address 0 2430 OR 0 1749 address DAD 0x2430 DAD 0x1749 To add a filter definition to the database the PUR button should be used In order to add the filter to the database a filter name must be given in the window to the left of the button When the name is given and the Add button is pushed the current filter definition the multi line window of the filter condition will be added to the filter database The name of the filter will appear in the list of filters Window below the filter name To remove a filter select the required filter in the list of filters and push Bemowe button The filter database can be read from a file with the Umen button To save the filter database to a file use the Save button To add filter definitions from a file without deleting the existing filters in the database the _ Meme button should be used This will open the given file and add the filters to the existing filter database If the given filter name already exist in the filter database the name will be modified with an additional digit at the end of the name To use a filter from the filter database double click on the filter name and the filter condition will appear in the multi line filter condition window at the left side Note When packets are filtered out the delta times shown in the Time fields stil
6. synthesizer calibration FSCALI1 OxDF1E 0x00 Fregquency synthesizer calibration FSCALO 0 11 synthesizer calibration Output Power Setting When the file is selected the register values will be shown in Registers frame To modify the register value double click the register name The register name will appear in the Register update frame The value can be changed in the Value field Click on Apply to use the new value The changes can be seen in the Register frame The new values can be written to file with a click on the Write to file button Bluetooth Low Energy devices For Bluetooth Low Energy devices the Advertising channel must be selected Capturing device Radio Configuration Select fields Facket details Address book Display filter Time Advertising Channel 38 2425 MHz Connect to Initiator Address 1 12233445566 hex The capture device can be configured to follow a data connection between a specific Bluetooth low energy master initiator and slave device In the Radio Configuration tab click the checkbox next to the Connect to Initiator Address and write the address of the initiator master device If this option is not selected the capture device will start following the first data connection that appears on the current advertising channel 15 30 TEXAS SWRU187D INSTRUMENTS
7. NSTRUMENTS Addr Val Description PKTLEN OxDFO2 OxFD Packet length 1 OxDF03 0x04 Packet automation control PKTCTRLO OxDF04 0x05 Packet automation control FSCTRL1 OxDF07 0x07 Frequency synthesizer control FREQ2 0 1 control word high byte 0 80 control word middle byte FREQO OxDFOB 0x00 Frequency control word low byte MDMCFGA4 OxDFOC Ox2D Modem configuration MDMCFG3 OxDFOD Ox3B Modem configuration MDMCFG2 OxDFOE 0x73 Modem configuration MDMCFG1 OxDFOF 0x22 Modem configuration MDMCFGO OxDF10 O0xF8 Modem configuration DEVIATN OxDF11 0x00 Modem deviation setting when FSK modulation is enabled MCSM1 OxDF13 0x0C Main Radio Control State Machine configuration MCSMO OxDF14 0x10 Main Radio Control State Machine configuration FOCCFG 10 Offset Compensation Configuration BSCFG 0xDF16 0x1C Bit synchronization Configuration AGCCTRL2 7 control AGCCTRL1 OxDF18 0x00 AGC control AGCCTRLO OxDF19 0xB2 AGC control FREND1 0 5 RX configuration FRENDO OxDF1B 0x10 Front end RX configuration FSCAL3 synthesizer calibration FSCAL2
8. 0 0 gt n Length Packet Information Bit 0 1 gt n Length 2 FCS The checksum of the frame has been replaced by the radio chip in the following way BYTE 1 RSSI and if Correlation used this byte is also used to calculate the LQI value BYTE 2 Bit 7 Indicate CRC OK or not Bit 6 0 If Correlation used Correlation value If Correlation not used LQI See data sheet for the applicable chip for further details Spare The number of spare bytes depends on the total amount of bytes used by the packet sniffer to save the packet The number of bytes depends on the protocol and can bee seen from the description of the packet format under the help menu 24 30 TEXAS SWRU187D INSTRUMENTS 6 Exporting register settings from SmartRF Studio SmartRF Studio and its user manual be downloaded from the Texas Instruments web site See the SmartRF Studio user manual for more details When the correct device has been selected a list of preferred register settings will be shown in the Normal view tab After selecting the preferred register settings and optionally changing any of the register values choose File Export code from the menu to start the code export This will open the following window 7 Code export Export Format m Comment Delimiters NEN Preview 0x06 Frequency Synthesizer Contre 0 000 Output Pin Configquratic
9. The SmartRF Packet Sniffer is PC software application used to display and store RF packets captured with a listening RF HW node Various RF protocols are supported The Packet Sniffer filters and decodes packets and displays them in a convenient way with options for filtering and storage to a binary file format The Packet Sniffer is installed separately from SmartRF Studio and must be downloaded from the Texas Instruments web site A shortcut for all supported signalling protocols will be placed on the Windows Start menu after the installation 3 30 NSTRUMENTS 1 1 Protocols SWRU187D The supported protocols can be seen in the Launch window when starting the packet sniffer The following combinations of protocols and HW RF Device are supported Protocol Version Capture device Bluetooth low energy Bluetooth core spec 4 0 CC2540 USB Dongle 2540 SmartRFOSEB CC2531 USB Dongle CC2530EM SmartRFOAEB SmartRFO5EB CC2520EM SmartRFO5EB CC2430EM SmartRFO4EB SmartRFO5EB CC2431EM SmartRFO4EB SmartRFO5EB CC2430DB 2007 PRO 2006 2003 CC2531 USB Dongle CC2530EM SmartRFO4EB SmartRFO5EB CC2520EM SmartRFO5EB CC2430EM SmartRFO4EB SmartRFO5EB CC2431EM SmartRFO4EB SmartRFO5EB CC2430DB CC2531 USB Dongle CC2530EM SmartRFO4EB SmartRFO5EB CC2520EM SmartRFO5EB CC2430EM SmartRFO4EB SmartRFO5EB CC2431EM SmartRFO4EB SmartRFO5EB CC2430DB RF4CE ZigBee RF4CE 1 0 1 Simp
10. com Broadband www ti com broadband Clocks and Timers www ti com clocks Digital Control www ti com digitalcontrol Interface interface ti com Medical www ti com medical Logic logic ti com Military www ti com military Power Mgmt power ti com Optical Networking www ti com opticalnetwork Microcontrollers microcontroller ti com Security www ti com security RFID www ti rfid com Telephony www ti com telephony RF IF and ZigBee Solutions www ti com lprf Video amp Imaging www ti com video Wireless www ti com wireless Mailing Address Texas Instruments Post Office Box 655303 Dallas Texas 75265 Copyright 2010 Texas Instruments Incorporated 30 30
11. should obtain the latest relevant information before placing orders and should verify that such information is current and complete All products are sold subject to 5 terms and conditions of sale supplied at the time of order acknowledgment warrants performance of its hardware products to the specifications applicable at the time of sale in accordance with 5 standard warranty Testing and other quality control techniques are used to the extent deems necessary to support this warranty Except where mandated by government requirements testing of all parameters of each product is not necessarily performed assumes no liability for applications assistance or customer product design Customers are responsible for their products and applications using components To minimize the risks associated with customer products and applications customers should provide adequate design and operating safeguards TI does not warrant or represent that any license either express or implied is granted under any TI patent right copyright mask work right or other TI intellectual property right relating to any combination machine or process in which TI products or services are used Information published by TI regarding third party products or services does not constitute a license from TI to use such products or services or a warranty or endorsement thereof Use of such information may require a license from a third party under the patents
12. top left corner or single clicking on the X symbol in the top right corner ltems marked with a star are saved to Windows registry between each session For the ZigBee and protocol there are options to select the protocol version This can be c ZigBee 2006 seen in the toolbar as a drop down lis The selected version will be saved between each session Cash buffer size The cash buffer is a RAM buffer that is allocated to contain packets that is displayed by the packet sniffer It is used to optimize the access time when the GUI asks for information to display a packet The cash buffer function try to anticipate which packets that will be requested next and will try to load the buffer with these packets in the background Clock multiplier A clock multiplier which allows you to compensate for clock speed differences on the connected device and the hardware running the network application Synchronizing the clock on the sniffer device with the clock on the network devices Example Ensure that the time stamps are given in microseconds to get accurate numbers default Measure a known time interval e g the distance between a few beacons for the IEEE 802 15 4 protocol Divide the desired value by the real value and enter this floating point factor into this field 12 30 TEXAS INSTRUMENTS SWRU187D 2 4 Capturing device The Capturing device tab is used to select the required d
13. 2 8 Address book The address book contains all known Node addresses from the most recent session By selecting Auto register on by default the packet sniffer will register all addresses automatically and add entries into the address book The example below show the fields defined for the IEEE 802 15 4 ZigBee protocols Capturing device Radio Configuration Select fields Packet details Address book Display filter Time line Remove Auta registered 0 00011 0 0000000001020316 Auto register Auta reqistered 1 00000 Auta registered 2 O 004C 0001 246 000008 M UF Auta registered 3 O61 43E 0011 2460000088061 giis Move DOWN Figure 15 Address book panel Nodes are added replaced manually by clicking the Add button or by pressing the Enter key while standing in one of the top fields Nodes can be removed by clicking the Remove button or by pressing the Delete key while a node is selected in the address list Nodes can be moved up down by using the rightmost buttons or the Alt U and Alt D key combinations Depending on the protocol it may be required with manual editing of the fields in the address book to correct for address conflicts Below are examples where manual editing for the IEEE 802 15 4 protocol are given e There has been a PAN ID conflict e device has left the network and ano
14. DETAI 17 2 8 ADDRESS BODR 18 2 9 19 REN 20 3 ENCRYPTED PAYLOAD 1 7 0 022990062000 09 690204500229 TAE s Pen CEPS 22 3 1 HOW THE DECRYPTION PEATURE wou deeds ame deb Mc det e ed 27 9 2 SIVA TOI M MO 22 4 KNOW ISSUES 1 3 0220 00 154 cde di ease acetals aes vec Con ceo cese Ves abes dva od Uode das o 23 4 1 BEUEDIOOTH EOW ENERGY V Eon lo oc ense 23 5 FORMAT OF PACKETS SAVED cite neh 24 6 EXPORTING REGISTER SETTINGS FROM SMARTRE 8 1 25 7 E RES RINT TT TETTE 26 8 TROUBLESHOOTING 2 2 59 20 27 9 GENERAL INFORMATION 0000 0 29 9 1 DOCUMENT HISTORY sat T 29 2 30 TEXAS SWRU187D NSTRUMENTS 1 Introduction
15. SWRU187D NSTRUMENTS 7 Help The packet sniffer provides help through so called tool tips By moving the cursor over a field e g a button or a text field and holding it in the same position for about half a second the text will appear in a yellow box slightly below the cursor Capturing device Radio Configuration Select fields Facket details Address book Display filter Time Field Name Template Filter management Frame cantral field Sec x Phd s First And Add Filter condition IFCF B Add Remove All Tele The complete Filter consist of conditions in horizontal and vertical direction The conditions in horizontal direction will be checked with an AND operator The conditions in the vertical direction will be checked with an operator Remove Open Save Menge n Figure 20 Display filter panel with the tool tip shown Keyboard and mouse button events will cause the tool tip to disappear or not be displayed at all 26 30 TEXAS SWRU187D INSTRUMENTS 8 Troubleshooting This section contains some troubleshooting tips that should be used if the packet sniffer does not function as expected Execute the steps one by one until the problem is solved A The evaluation board is not detected it does not appear in the list box in the Setup tab Using smartRFOAEB CC2430EM Make sure that the USB c
16. able is connected and that a CC2430EM is mounted Check that the jumper between OUT IN is connected Check that the jumpers on P3 are mounted correctly see the CC2430DK user manual Press the Reset button Using 2430DB e sure that the USB cable is connected and power switch is in USB position Check that the jumper on 1 2 is mounted e Check that all tree jumpers on P5 are mounted Press the Reset button B When pressing the start button the following message is given Not able to Start Sniffer Try upgrade of USB firmware Check if latest Firmware version of the USB controller is used This should be version 0037 or later This can be seen by using the SmartRF Flash Programmer from Texas Instruments The figure below show an example from the flash programmer The column EB firmware rev will show the version The Flash Programmer can be download from the Texas Instruments web site 35 Texas Instruments SmartRF Flash Programmer Sustem on Chip application LI SB application serial EB bootloader 5 430 TEXAS INSTRUMENTS _ Chip type EB type firmware EB firmware rev WERT TIT 0400 0037 Actions Erase and program Erase program and verify Append and verify Verify against hex file Head flash inta hex file Perform actions Figure 21 SmartRF Flash Programmer C When pressing the sta
17. at exceeds the connection timeout When the actual connection is terminated due to a connection timeout the sniffer must be stopped click the pause stop icon and restarted click the play icon in order to follow a new connection 23 30 TEXAS SWRU187D NSTRUMENTS 5 Format of packets saved to file The figure below describe the packet format for packets saved to a Packet Sniffer Data PSD file The number of bytes is given for each field 1 4 1 S Spare FCS Payload Length Timestamp Packet number Packet Information Figure 18 Packet format in PSD file Packet Information New field introduced from version 2 3 0 Contains information used by the packet sniffer to read the data correctly Bit Length includes FCS Bit 1 Correlation used Bit 2 Incomplete packet Bit 3 7 Not used Timestamp 64 bit counter value To calculate the time in microseconds this value must be divided by a number depending on the clock speed used to drive the counter tics on the target E g CC2430EM gt 32 10 gt 26 SmartRFOSEB CC2520EM gt 24 The timestamp on the first packet will be used as offset value for all packets That means that packet number 1 will be shown in the packet sniffer with time 0 Length The length will or will not include the FCS field depending on Bit O in the Packet information Payload Packet Information Bit
18. cy CCl I4 Time stamp Millisecands Payload format Bytes Selected Fields LGI RSSI Figure 13 Select Fields panel Tips Extended selection is used to operate the controls select a range of fields o Click and drag over the fields that should be selected o Select the first field hold down the Shift key and select the last field select unselect a single field o Hold down the Ctrl key and click on the field to be toggled 16 30 Texas SWRU187D NSTRUMENTS 2 7 Packet details By double clicking on a packet in the packet list additional details as shown below will be displayed This example show details from the SimpliciT protocol Capturing device Radio Configuration Select fielde Packet detalls Address book Display filter Time line Packet index 1 Length 11 Haw data hex 41 88 00 10 20 BB BB 44 FF FF ASSI dBm 34 Correlation value 105 CAC OF 1 Figure 14 Packet details panel The packet index shows the index for each captured packet starting with index 1 for the first packet The RSSI value is read from the connected device and adjusted with a given offset value to get an approximate value in dBm The correlation value is equal to the value read from the connected device See the datasheet of the connected device for detailed information on the RSSI and correlation values 17 30 TEXAS SWRU187D NSTRUMENTS
19. ertical direction are evaluated with the OR operator To remove a line from the multi line filter condition select the required line and click the Remove button To remove all the lines from the multi line filter condition click the button The button abdal will activate the filter and the packet window will be redrawn with packets that comply with the given filter condition The 9f button should be used to disable the filter function The packet window will be redrawn again and all packets will be visible The filter function can be enabled and disabled while the sniffer is running 19 30 TEXAS SWRU187D INSTRUMENTS Capturing device Radio Configuration Select fields Packet details Address book Display filter Time Field Mame Template Filter management Frame field Sec x Pndaz First And Add Filter condition Remove FLF BLM Remove All Save Apply filter Menge Figure 16 Display filter panel Filter management On the right side of the panel a Filter management function is provided The filter management contains a database of defined filters The database can be saved to a file and read from a file The file is formatted as a plain text file and can be manually updated if required Below is an example of a filter database file The filter name is given within square brackets
20. evice Depending on the selected protocol the applicable devices will be shown in the list The list will automatically be updated when an applicable device is connected to a USB connector The Capturing device must be selected before the packet sniffer can be started which is done by clicking the tool bar button or hitting the F5 key Capturing device Radio Configuration Select fields Packet details Address book Display filter Time line Select capturing device ID 5451 Chip type CC2540 EB type 2540 USB Dongle Figure 12 Capturing device Sniffer communication interface If the EB type is CC Debugger and the chip type is 1110 or CC2510 an additional option will be visible in the Capturing device panel The sniffer communication interface must be selected The default value is USARTO and is applicable when CC Debugger is used together with the SmartRFCCxx10TB board See figure below Capturing device Aadio Configuration Select fields Packet details Address book Display filter Time line Select capturing device EB ID 1254 Chip type 1110 EB type Debugger Sniffer communication interface t J amp RHTU C 1 USART1 should be used for all other combinations with CC1110EM or CC2510EM 13 30 TEXAS SWRU187D NSTRUMENTS 2 5 Radio Configuration The Radio Configuration tab is used to select the parameter values required to configure the
21. he BLE plugin directory Typically C Program Files Texas Instruments WPacket Sniffer General Plugin ble 2 Modify Itk txt with the right The format is MSO LSO E g If the Itk 0x001 122334455667 78899AABBCCDDEEFF The file will have to be 00112233445566778899AABBCCDDEEFF as its very first line 3 Run the sniffer like normal Encrypted packets will be decrypted and flagged as Encryption Enabled Payload and MIC will be displayed on the GUI 3 2 Limitations Decryption is supported with the following limitations 1 The decryption will fail if one or more packets are sent but failed to be captured by the capturing device The decryption algorithm depends on the timing packet counters one for each side and the direction of the packet There are algorithms in the parser to determine these parameters but they can t capture all the scenarios where or more packets missing 22 30 TEXAS SWRU187D NSTRUMENTS 4 Know Issues 4 1 Bluetooth Low Energy The capture device currently ignores the connection timeout parameter for an active connection This means that the sniffer will not Know that a connection between two BLE devices is down if no new packets are received for the duration of the connection timeout The reason this is not supported by the sniffer is to remedy the case where the sniffer follows a data connection between two remote devices and thus is likely to lose a number of packets for a period of time th
22. ified to give the real values of the requested fields The value is indicated with an x in the template If the filter condition of a field with sub fields only requires evaluating the first sub field value the sub field value can be given without brackets Example Figure 16 below shows an example from the IEEE 802 15 4 ZigBee protocols The template of the Frame control field is FCF Type x Pnd x Intra PAN x If itis only required to test on the Type sub field the condition can be simplified the following Way FCF BCN Note This is only possible for the first field in the definition of sub fields It is not required to fill in the values of all fields If the filter condition only requires checking some of the sub fields only those fields should be given Example Same as previous example but this time it includes checking the Type and values This condition should be given as follows FCF Type BCN Ack_req 1 When all conditions that should be evaluated with the AND operator are defined the condition can be moved to the multi line Filter condition window with the L J button Enter will give the same result In this window several filter conditions can be added and all the conditions in vertical direction will be evaluated with the OR operator To summarize Conditions in the horizontal direction are evaluated with the AND operator Conditions in v
23. in such safety critical applications notwithstanding any applications related information or support that may be provided by Further Buyers must fully indemnify and its representatives against any damages arising out of the use of TI products in such safety critical applications TI products are neither designed nor intended for use in military aerospace applications or environments unless the TI products are specifically designated by TI as military grade or enhanced plastic Only products designated by TI as military grade meet military specifications Buyers acknowledge and agree that any such use of TI products which TI has not designated as military grade is solely at the Buyer s risk and that they are solely responsible for compliance with all legal and regulatory requirements in connection with such use TI products are neither designed nor intended for use in automotive applications or environments unless the specific TI products are designated by TI as compliant with ISO TS 16949 requirements Buyers acknowledge and agree that if they use any non designated products in automotive applications TI will not be responsible for any failure to meet such requirements Following are URLs where you can obtain information on other Texas Instruments products and application solutions Products Applications Amplifiers amplifier ti com Audio www ti com audio Data Converters dataconverter ti com Automotive www ti com automotive DSP dsp ti
24. irmware on the CC2531 Dongle it must be connected to SmartRFOSEB the CC Debugger via the debug connector See user manual for the flash programmer for details on how to use the flash programmer Figure 7 CC Debugger SmartRFCCxx10TB Figure 8 CC2540 USB Dongle The CC2540 USB Dongle must be pre programmed with special firmware in order to work with the packet sniffer After installation of the packet sniffer the hex file to be programmed can be found on the following directory installation directory XGeneral Firmware sniffer fw cc2540 hex The firmware can be programmed with the SmartRF Flash Programmer To program the firmware on the CC2540 Dongle it must be connected to SmartRFOSEB or the CC Debugger via the debug connector See user manual for the flash programmer for details on how to use the flash programmer 8 30 TEXAS SWRU187D NSTRUMENTS 1 3 Data flow On the PC side the packets will be stored in a disk buffer The total amount of packets that can be stored depends on the packet size and the size of the hard disk During operation the packets will be cached in a RAM buffer to improve the access time when a packet is to be displayed in the GUI Figure 9 Dataflow for the packet sniffer SoC below shows the data flow for the packet sniffer Connected Device PC y Abstraction layer SoC Transceiver 8 kB buffer Data Buffer 7 USB controller Temporary Di
25. istered 3 Packet count 286 Error count 6 Filter OFF SWRU187D TEXAS SWRU187D INSTRUMENTS Table of contents 1 INTRODUCTION id ai o De Lr 3 1 1 P 4 1 2 HARDWARE PLATFORM orean aaa c dane ace dase tnt 5 1 3 9 1 4 SOLD OE RS ON a DL D A IRE CoE 9 2 USER INTERFACE a 10 2 1 WINDOW eee te ee A ae Aces MR MA 10 252 PACKET SNIFFER WINDOW AN ACTIVE 6 5 0000000 10 2 3 AND POOLB AR 12 2 4 CAPTURINGODE VIO E 13 2 5 RADIO COONEIGUERATION cud tn p A eL 14 2 6 SELECT bent Ne SOE ee 16 2 7 PACKET
26. l show the delta time to the previous packet captured not the previous packet shown 2 10 Time line The time line displays all received packets ordered horizontally by the time of reception and vertically by source or destination address Selecting a packet from the time line will instantly be reflected in the packet list and vice versa thus allowing for efficient navigation in large collections of packets 20 30 Texas SWRU187D NSTRUMENTS Capturing device Radio Configuration Select fields Packet details Address book Display filter Time line SOURCE lt 148 270 gt Unregistered broadcast E E E PEPE 5 PPP Auta registered 0 ES NH INI E Auto registered 1 E Auta registered 2 a Auto registered 3 EFE E i TTT TTT Figure 17 Time line panel Double click in the left section of the time line to switch between destination and source Packets are selected by clicking and or holding down the left mouse button The time line can be scrolled clicking and holding down the right mouse button drag 21 30 TEXAS SWRU187D NSTRUMENTS 3 Encrypted Payload Decryption of encrypted data is only supported by the Bluetooth low energy packet parser 3 1 How to use decryption feature 1 Copy the file Itk txt with the Long term key to the root directory c V The file can be found in t
27. liciT CC1111 USB Dongle CC2510EM SmartRFO4EB SmartRFO5EB CC2511 USB Dongle CC2531 USB Dongle CC2530EM SmartRFO4EB SmartRFO5EB CC2520EM SmartRFO5EB CC2430EM SmartRFO4EB SmartRFO5EB CC2431EM SmartRFO4EB SmartRFO5EB CC2430DB CC1110EM SmartRFO4EB SmartRFO5EB CC1111 USB Dongle CC2510EM SmartRFO4EB SmartRFO5EB CC2511 USB Dongle Table 1 Supported protocols Can be used to capture packets from CC2540 Bluetooth low energy devices 2420 2430 2431 2480 2520 2530 2531 ZigBee 2003 2420 2400 2420 2533 2530 2531 2430 2431 2520 2530 2531 1100 1100 CC1110EM SmartRF04EB SmartRFO5EB CC1101 1110 1111 CC430 CC2500 CC2510 CC2511 2420 2430 2431 2480 2520 2530 2531 2533 1100 1100 1101 1150 1110 1111 CC430 CC2500 CC2550 2510 2511 When sniffing in the sub 1 GHz frequency bands you need hardware that supports the operating frequencies Also note that CC1110 and CC1111 have limited support for some frequencies supported by CC1100E 4 30 TEXAS SWRU187D INSTRUMENTS 1 2 Hardware Platform The packet sniffer can be used with different HW platforms The following HW can be used CC2400EB CC2420EM CC2430DB SmartRFO4EB CC2430EM CC2530EM 1110
28. or CC2510EM SmartRFOSEB CC2430EM CC1110EM CC2510EM 2520 or 2530 CC2531 USB Dongle CC Debugger SmartRFCCxx10TB CC2540 USB Dongle The applicable board must be connected to the PC through USB Figure 1 CC2400EB CC2420 Note The Packet Sniffer started when selecting IEEE802 15 4 ZigBee 2420 will be different from the others A different GUI application will be started The most important difference is that the packets will only be stored in a RAM buffer That means the GUI application will not be able to handle more packets when the buffer is full See the user manual for Packet Sniffer CC2420 for more details The manual can be found under the documentation option of the start menu start gt Texas Instruments Packet oniffer 2 Documentation Packet Sniffer CC2420 user manual 5 30 TEXAS SWRU187D INSTRUMENTS Figure 2 CC2430DB s um 0 i 4 nes Smar tRF 4EB 1 9 Smar tRF 94 Evalue Chipeon AS 824 UA X N X E E un 9 28 Pod Vo 1 2 gt 2 RT qur 4 Figure 3 SmartRFO4EB Note Observe the jumpers on header P3 For revision A and B of CC2430 register CHVER s 0x02 the jumpers must be set in the horizontal direction in parallel with the displa
29. or other intellectual property of the third party or a license from TI under the patents or other intellectual property of Reproduction of TI information data books or data sheets is permissible only if reproduction is without alteration and is accompanied by all associated warranties conditions limitations and notices Reproduction of this information with alteration is an unfair and deceptive business practice TI is not responsible or liable for such altered documentation Information of third parties may be subject to additional restrictions Resale of TI products or services with statements different from or beyond the parameters stated by TI for that product or service voids all express and any implied warranties for the associated product or service and is an unfair and deceptive business practice Tl is not responsible or liable for any such statements TI products are not authorized for use in safety critical applications such as life support where a failure of the TI product would reasonably be expected to cause severe personal injury or death unless officers of the parties have executed an agreement specifically governing such use Buyers represent that they have all necessary expertise in the safety and regulatory ramifications of their applications and acknowledge and agree that they are solely responsible for all legal regulatory and safety related requirements concerning their products and any use of TI products
30. rERF AEB CC2430EM or 24300 Click Start button bo launch Packet Sniffer Figure 10 Screen shot of the packet sniffer launch window To start the packet sniffer a combination of protocol and chip type should be selected Then the start button should be clicked If a packet sniffer session has been started and the launch window is closed the sniffer session will still remain active and must be closed explicit if required 2 2 gt Packet Sniffer window of an active session The main window of the packet sniffer can be divided into two sections Atthe top A packet list which displays the various fields of the decoded packets At the bottom The following seven tabs Capturing device Selects which capturing device to use Radio Configuration Input data to configure the radio of the capturing device E g Channel number for IEEE 802 15 4 devices Select fields Select which fields to display in the packet list Packet details Displays additional packet details e g raw data o Address book Contains all known nodes from the current session Addresses be registered automatically or manually and they can be changed or deleted o Display filter Packet filtering with user defined filter conditions A list of all fields which can be used to define the filter condition is given From this list a filter condition can be defined by combining these fields with AND and OR operators o Time line Displays a la
31. radio of the capturing device The parameters depend on the selected capturing device IEEE 802 15 4 devices For IEEE 802 15 4 devices the required channel must be selected Capturing device Radio Configuration Select fields Facket details Address book Display Filter Time line IEEE 802 15 4 Channel 1011 2435 MHz bd Proprietary devices These radios support a lot of programmable RF parameters Capturing device Radio Configuration Select fields Facket details Address book Display filter Time line Register settings Select File Registers Register Update 24 S3Mh2_ 2B5 kBaud 434MHz 250k aud Gl BbBMhz z5 kBaud Freg 2433MHz Aate sniffer 1110 smpl sritter cc1111 smpl suffer 1 0 Select Channel 6 Register Value FSCTRL1 TAME EX DU FREUZ FREHI 4 ae LIMAL icra r ro ranl no 3511 Browse Write to File Apply The radio settings should be given in a text file The file can be created by SmartRF Studio This makes it easy to get all the correct register settings calculated by SmartRF Studio See chapter 6 for further details After installation of the SmartRF M packet sniffer a default file will be available in the subdirectory of the applicable plugin The format of the file is shown in the example below 14 30 TEXAS SWRU187D
32. rge sequence of packets about 20 times as many as in the packet list sorted by either source or destination addresses The packet sniffer screenshot in Figure 11 shows example from the IEEE802 15 4 ZigBee protocol The status bar displays the total unfiltered number of captured packets the number of packets with errors checksum error and the number of occurrences of buffer overflow and the status of the filter function If filter is on it will show the number of packets which have passed current filter conditions 10 30 TEXAS Texas Instruments SmartRF Packet Sniffer IEEE 802 15 4 MAC and ZigBee 7006 ZigBee 2006 File Settings Help Capturing device SOURCE lInregistered broadcast MIE EEE Auto registered Auto registered 1 Auto registered 2 Auto registered 3 Facket count 286 INSTRUMENTS b og n Type Sec Pnd Ack req compr CHD 0 Type Sec Pnd compr ECH Type Pnd Ack req compr CHD 0 Radio Configuration lt 148 Error count Frame control field 0 0 Frame control field 0 0 Frame control field 0 Select fields 0 0 0 0 Packet details Filter OFF Sequence number Sequence Address book number 0x21 Sequence number Sequence number Sequence number Sequence number Sequence number 0x79 Sequence number FE
33. rt button the sniffer stops immediately the start button is not grayed out 27 30 TEXAS SWRU187D NSTRUMENTS Disconnect the USB cable from SmartRFO4EB or CC2430DB board and plug it back in Press the Reset button on the board Disconnect the power cable from all evaluation boards and install the latest version of the packet sniffer Reboot the computer D The program does not respond e Press the Reset button on the connected Evaluation Board EB E The packets are not decoded correctly e Packets with an FCS failure will probably not be parsed correctly FCS ERR sure that the packet really is correctly formatted compare the fields with the raw data the packet details tab F Weird packets appear in the packet sniffer when not transmitting anything e CC2430 will try receiving packets down to the RF noise floor Sometimes it will also decode packets which are decoded from noise only These will appear in the packet sniffer To avoid this enable FCS filtering in the toolbar G The packet sniffer stays idle and does not receive any packets after start button has been pressed e Check that correct channel is used the setup panel e Check the jumper settings see section 1 2 in this document If a SmartRFOAEB board with an CC2430EM module is used make sure that the jumpers are set correct depending on the chip revision Revision A and B register CHVER s 0x02 horizontal La
34. sk file Data Buffer Cache buffer In RAM Screen GUI Figure 9 Dataflow for the packet sniffer SoC For the moment it is only the CC2520 transceiver that is supported by the packet sniffer The buffer is only applicable for the System on Chip devices SoC If the PC application is not able to read the packets from the connected devices data buffer fast enough an Overflow error will be given by the device and the packet sniffer will show the error on screen 1 4 Software The firmware on the SoC s required to run the sniffer will be checked and loaded automatically if needed when the sniffer is started This can be seen on the status bar in the lower left corner The same apply for the USB controller but the user will be asked to do the update and the user has the possibility to reject the update In that case it might be that the sniffer is not working properly The following operating systems are supported Windows XP Pro 32 bit Windows Vista 32 bit e Windows 7 32 bit 9 30 TEXAS SWRU187D INSTRUMENTS 2 User Interface 2 1 Launch Window To select between the different options for protocol and HW configuration a launch window will be shown when starting the sniffer Texas Instuments Packet Sniffer Packet Sniffer TEXAS INSTRUMENTS Ver 2 10 1 Select Protocol and chip type Required Hw platform Sma
35. ter revisions vertical H Error message when trying to start the packet sniffer If an error message about missing msvcp80 dll appears or the error message shown below appears when attempting to start the application you may be required to install an additional package from Microsoft The package contains some additional runtime components needed by applications developed with Visual To resolve this problem download the file vcredist x86 exe from the URL below and install the package http www microsoft com Downloads details aspx FamilyID 32bc1bee a3f9 4c13 9c99 220b62a191ee amp displaylang en 28 30 TEXAS SWRU187D NSTRUMENTS 9 General Information 9 1 Document History Revision Date Description Changes 22 10 2010 The table with combinations of protocols HW has been updated A picture of the HW platform for CC2420 is added Document updated with information about capturing device used for the Bluetooth Low 25 08 2010 Energy protocol Screen shots have been updated 03 11 2009 SmartRFCCxx10TB added as possible capturing device 19 02 2009 Description for SmartRFOSEB added 29 30 TEXAS SWRU187D NSTRUMENTS IMPORTANT NOTICE Texas Instruments Incorporated and its subsidiaries TI reserve the right to make corrections modifications enhancements improvements and other changes to its products and services at any time and to discontinue any product or service without notice Customers
36. ther device has been given an already used short address the extended address will be replaced e Association response commands have not been detected Tips Fast editing of node names can be done using the following procedure Select the first auto registered item in the address list Hit Enter to copy the data and move to the node name field Enter the new name Hit Enter to replace the old entry and move back to the address list Move one line down by using the down arrow Go to step 2 18 30 TEXAS SWRU187D NSTRUMENTS 2 9 Display filter The Display filter tab allows for filtering on all fields defined in the Field Name window A template is provided to ease the definition of the filter condition The template will show the short name for each field If the field has sub fields the definition of all sub fields will be shown within brackets Some fields will be dependent of other fields This will also be shown in the template When the required field is selected the template can be moved to the single line Filter condition window by pushing the Fis button or the And button The First button will remove all existing conditions and set current template as the first condition The And button will add current template to the existing conditions and the conditions will be evaluated with the AND operator When the template has been moved to the single line Filter condition window it must be mod
37. y like in Figure 2 For newer revisions of CC2430 the jumpers should be set in the vertical direction this is the default position 6 30 TEXAS SWRU187D INSTRUMENTS MN Smar 1 5 Evaluation Board LJ Fa 15 ede nr nme AAA n bea ES Poe ae Figure 5 CC2511 CC1111 USB Dongle Both the CC2511 and the CC1111 USB Dongle can be used as capturing device with the packet sniffer The Dongles must be pre programmed with special firmware in order to work with the packet sniffer After installation of the packet sniffer the hex file to be programmed can be found on the following directory installation directory gt General Firmware sniffer fw ccxx11 hex The firmware can be programmed with the SmartRF Flash Programmer To program the firmware on the dongle it must be connected to SmartRFOSEB or the CC Debugger via the debug connector See user manual for the flash programmer for details on how to use the flash programmer 7 30 TEXAS SWRU187D INSTRUMENTS Figure 6 CC2531 USB Dongle The CC2531 USB Dongle must be pre programmed with special firmware in order to work with the packet sniffer After installation of the packet sniffer the hex file to be programmed can be found on the following directory installation directory XGeneral Firmware sniffer fw cc2531 hex The firmware can be programmed with the SmartRF Flash Programmer To program the f
Download Pdf Manuals
Related Search