Z-Wave Sniffing, Zniffing And You: A Guide To Pulling Packets From Thin Air

Maybe you've heard people around the community talking about sniffing packets or even misspelling the word "sniffer" as "zniffer". What are they talking about? Maybe some of your friends or relatives have even tried it. Maybe you've even considered experimenting with "zniffing" or "sniffing" but you don't know where to get started?

This is a confusing time in your home automation lives. Your hubs and devices pools are growing and maturing. You might be experiencing new and exciting feelings about certain devices; even feelings about wanting to "sniff" these devices. This topic is intended to help you approach these feelings in an honest and non-judgemental way. Information about "sniffing" and "zniffing" is everywhere but it's important to know that there is a place where if you have concerns, questions or just need support you can get it.

I don't know if it was the stress of the competition with my friends but I began experimenting with "sniffing" in my early Hubitat life. I began looking at websites for "sniffing" when my wife and family weren't around. I eventually stayed up nights in seclusion making plans to "sniff." Eventually I didn't hide it anymore. I became so emboldened that I talked about "sniffing" all the time.

My wife tried to intervene but my interests in "sniffing" only grew. I bought a "sniffer" called the Suphacap and began "sniffing" one or two of my devices at a time. Eventually, I was "sniffing" ALL of my devices at once all the time. My house became a center of "sniffing" where my friend would come and have their devices "sniffed" too but it still wasn't enough.

I then built a "zniffer" and life began to change little by little. I began to see the whole picture. I could see how a device interacted all the way with another device. I could see how those devices were affecting me. I stopped doing things so often that would hurt myself. Eventually, I was able to stop "sniffing" completely and just "zniff".
I am a completely changed man.

I want to share with you how to create a "zniffer" so if you have this in your toolbox and you are confronted with "sniffing" you will have the strength to avoid it or at least make an informed choice before doing it.

Okay, cut the crap. There's no way I can keep doing that and actually get through any useful information.

There really is no difference between sniffing and zniffing. It's just two products doing the same thing. The Suphammer Suphacap did its very best before there was a cheap, good alternative. Suphacap is just a common, unspecialized radio receiver that is capable of seeing traffic in the Z-Wave bands and a smart Norwegian attached it to a board and wrote firmware to have it read signals and parse them into Z-Wave commands. It has shortcomings. So many that I'm not going to even try to list them. I love that he had the project and the tool but it's not worth buying anymore.

Because... now... you can get Silicon Labs' tools for free and without signing their NDA. Now you can build a Zniffer with their official firmware and use their tools for debugging and capturing Z-Wave frames. Hoorah.

I take no responsibility for wrong doings you commit with this power or damage to you or your controller, UZB3, relationship, etc. You are on your own.

Requirements:

  • A silabs.com account.
  • A ACC-UZB3-U-STA which is also commonly called a UZB3 (I bought mine from here)
  • Windows (Because you actually want to get work done and a computer is more than a facebook machine. Jab, jab, poke, poke.)

Steps to Flash:

  • Don't plug in the UZB3
  • Using the silabs.com account download the "Z-Wave Programmer" and "Z-Wave Zniffer" programs from here. They are linked in the "Hardware and Software Features" section on the right side.
  • Install both. The installer file for "Z-Wave Programmer" is in ZWaveProgrammer_v2_99/PC/Z-WaveProgrammerSetup.mis. The installer file for "Z-Wave Zniffer" is in Zniffer_v4_57/PC/ZWaveZnifferSetup.msi.
  • Install the programmer driver. This can be done by right clicking the zw05xxprg.inf file in Zniffer_v4_57\PC\ZW050x_USB_Programming_Driver
  • Plug in the UZB3.
  • In device manager make sure that it shows up as "Sigma Designs ZWave programming interface". If it does not, update the driver and go through the prompts to install a driver from disk and choose the zw05xxprg.inf file from the location above.
  • Open the "Z-Wave Programmer" software.
    • Under the "View" menu make sure "ZW050x" is checked
    • Under the "Tools" menu click "Detect Target"
    • Under the "Settings" menu make sure to select the COM port with the UZB3
  • Flash the Zniffer firmware to convert the UZB3 stick from a controller to a Zniffer.
    • This is done by clicking the "ZW050x" tab
    • In the HEX File field select the sniffer_ZW050x_USBVCP.hex file from the Zniffer_v4_57\Z-Wave_Firmware folder.
    • Click "Program and Verify". This step took about 10 minutes. Don't panic.
  • If it says successful you're done! If it doesn't... try the flash again after re-installing the driver and unplugging the UZB3.

Now that your UZB3 is flashed to a Zniffer... GET ZNIFFERING.

Steps to Zniff:

  • Unplug the UZB3
  • Install the UZB driver by right clicking the uzb.inf file in Zniffer_v4_57/PC.
  • Replug the UZB3.
  • In the device manager make sure that it shows up as "UZB". If it does not, update the driver and go through the prompts to install a driver form disk and choose the uzb.inf file from the location above.
  • Open the "Z-Wave Zniffer 4 Secured" software.
    • Under the "Capture" menu click "Detect Zniffer Modules"
    • Under the "Capture" menu click "Port Selection" and choose the COM that the UZB3 is on
    • In the Frequency drop-down below the menu choose your frequency (I only tested this for US)
    • Click the "Start new trace" button (Green "play" icon)

From here... we'll all sort of have to go on an adventure together to understand what all of this trace information means.

Thanks to:
@chuck for the digikey link for the UZB3. They seem like a good vendor.
@csteele for some added tips for those of you using Mac and a Windows VM.

31 Likes

Also, I don't know if this is in the correct section.

Also, reserved.

And one more. Why not.

I don't own a Windows machine so I used VirtualBox and a Win10 VM with the UZB 'passed thru' from OSX to Win10. The Com port would keep vanishing during the process. Probably due to the programmer switching between read, erase and write. I ended up clicking Read then saving that image to HDD. Then I clicked the Erase button. Those two went easily but to program it, took multiple swings.. and misses. Eventually it got to the "unplug and replug" step and after that it completed successfully.

1 Like

Do us potential Zniffers need to order region specifiic Zwave controllers ( ACC-UZB3-U-STA) or can they be software defined ??

Edit: found the answer - we need to order regional varieties but struggling to find an AUS/NZ version. :disappointed:

EDIT (21/10/20): ACC-UZB3-H-STA works great in Aus

1 Like

Mouser is also an alternate vendor:
ACC-UZB3-U-STA

and maybe $2 cheaper.

1 Like

AWESOME !!! Worked like a charm -- good instructions on how to get it going.

The one thing I noticed on Win7 was the com port needed to be the sigma device not the UBZ3 com since that disappeared so I figured out the com port should have been 6 and once I got that checked the flashing went smoothly and once that was done it auto removed the device then re-added it as a UBZ3 device on com4.

2 Likes

I can't say for certain if it actually works but... with the US UZB3 I have the option to choose other region's frequencies in Zniffer.

I don't have any other frequencies to test it with though.

Yeah, there’s the rub. Is It just setting up the software or does the stick have a tunable radio ??
I’ll send out an email enquiry to SiliconLabs.

Hey, If your up for it, could you set your stick to AUS freq. and then try to communicate with your US devices ??

@codahq

When I go to Digikey (canada) I have 2 options:

ACC-UZB3-U-STA - CONTROLLER USB Z-WAVE
ACC-UZB3-U-BRG - UZB3 BRIDGE CTRLR W/SAW FILTER

Should I stick to the STA ? what's the difference ?

https://www.digikey.ca/products/en/rf-if-and-rfid/rf-evaluation-and-development-kits-boards/859?k=uzb3&k=&pkeyword=uzb3&sv=0&pv139=299565&sf=0&quantity=&ColumnSort=0&page=1&pageSize=25

Thank you for this!! - just ordered one from DigiKey

This seems like the right time to start zniffing packets!

Cw_i1kKXcAAZoEF

(shamelessly copied from that yellow lab...meth lab meme.)

When I set it to ANZ, I see no packets. I put it back to US and packets show as soon as I click Start Capture.

I have another device that is capable of operating at ANZ frequency and when I put it into Include, I see packets from that device. I do not see US frequency packets when set to ANZ. Therefore, I'd say it does in fact receive at multiple (settable) frequencies.

2 Likes

Does it have to be a specific stick I had bought a aeotec g5 for this (as far as I'd got)

Try it.

The programmer software is available and you have the stick.

Screen Shot 2020-03-06 at 7.07.41 AM

Tell us the results :slight_smile:

Lol thanks, down side I actually have no idea what I'm doing, but will try and knife and fork it

Edit then probably have no idea what I'm looking at, but God loves a tryer

1 Like

If you don't have a lot of experience with Wireshark or other packet capture tools, a Zniffer isn't very useful.

It tells you nothing, you have to pry info from it's reluctant fist. :slight_smile:

1 Like

I have the pc controler software, and have it paired but then I'm at a loss, I just want to prove to HE my mesh is ok :cry:

1 Like

Low probability that it will. You have to 'hear' the packets. And the mesh is supposed to 'grow' bigger than one radio can hear. Therefore, you'll be chasing the signals around without great proof.

Any ideas? Or have you ever had a routing table disappear from a stick after powering down?