This repository contains the packets used during the experiments of my Thesis as well as captures of the resulting traffic.
The complete report can be found at the following link (not yet available)
We considered 2 different gateways for our experiments. The IKEA Dirigera gateway and the Lidl Silvercrest Gateway. Our goal is to test if either of these gateways have implemented the network key lifetime recommendation added in ZigBee specification 21 (paragraph 4.7.3.9.2).
If a trust center detects that the frame counter for any device in its neighbor table is greater than 0x80000000 it should update the network key.
For each gateway we generate 4 types of packets.
| Experiment | src of packet |
dst of packet |
|---|---|---|
| 1 | NWK address and MAC address not in network | Bulb |
| 2 | NWK address and MAC address not in network | Gateway |
| 3 | NWK address and MAC address of remote | Bulb |
| 4 | NWK address and MAC address of remote | Gateway |
In the recommendation it states that the trust centre needs to detect a packet with a frame counter larger than 0x80000000. Thus we test both direct detection (ex 2, 4) and indirect detection (ex 1, 3).
The recommendation also specifies that the device needs to be present in the neighbour table of the device. As such we differentiate between this case using experiment 1,2 and 3,4.
We generated the packets using a customised version of the ZigDiggity framework. The process of generating the packets is explained in more detail in the report.
| Device | NWK key |
|---|---|
| IKEA | da:3c:01:d0:e5:80:0c:be:6c:87:88:61:ad:8c:c5:24 |
| Lidl | fe:d3:ca:37:1d:15:66:5e:d9:9b:b0:dd:aa:59:64:d4 |
Our networks resided on network which also contained other ZigBee networks. As a result we recommend that you add the filter wpan.dst_pan == 0x9915 for the IKEA pcap files in Wireshark and wpan.dst_pan == 1a3e for the Lidl pcap files. Also note that the example packets can deviate from our test packets in sequence numbers. However, this does not have any impact on the experiment.