Gear / Radio & RF / nRF52840 dongle
nRF

nRF52840 dongle

Sniffs 802.15.4 and BLE. Flash a sniffer firmware to watch Zigbee and Bluetooth.
10–15€ Radio & RF

What it does

The nRF52840 dongle is a small USB radio stick that, once flashed with the right sniffer firmware, captures 802.15.4 (Zigbee) or Bluetooth Low Energy traffic and feeds it straight into Wireshark. It is one of the cheapest ways to get a compatible radio for both wireless stacks.

Use cases

01
Sniff a Zigbee network join

Capture the key exchange when a device joins a mesh, the first step toward recovering the network key.

02
Watch BLE GATT traffic

Feed captured advertisements and ATT read/write requests into Wireshark's btle/btatt dissectors.

03
Confirm weak pairing

Unencrypted Just Works pairing or a static key shows up in the clear in the capture.

How you use it

Flash the matching sniffer firmware for the stack you're targeting, then capture into Wireshark:

# Zigbee/802.15.4: flash a KillerBee-compatible sniffer firmware
zbstumbler                      # find active Zigbee channels
zbdump -w capture.pcap          # capture to a file, open in Wireshark
# BLE: flash the Nordic nRF Sniffer firmware, then select the dongle as
# the capture interface from Wireshark's extcap list
Variants & pitfalls

One stack at a time. The dongle needs different firmware for Zigbee sniffing versus BLE sniffing; flashing one erases the other.

Channel hopping. Both Zigbee and BLE spread across channels - miss the active one and the capture stays empty.