nRF52840 dongle
What it does
The nRF52840 dongle is a small USB radio stick that, once flashed with the right sniffer firmware, captures 802.15.4 (Zigbee) or Bluetooth Low Energy traffic and feeds it straight into Wireshark. It is one of the cheapest ways to get a compatible radio for both wireless stacks.
Use cases
Capture the key exchange when a device joins a mesh, the first step toward recovering the network key.
Feed captured advertisements and ATT read/write requests into Wireshark's btle/btatt dissectors.
Unencrypted Just Works pairing or a static key shows up in the clear in the capture.
How you use it
Flash the matching sniffer firmware for the stack you're targeting, then capture into Wireshark:
# Zigbee/802.15.4: flash a KillerBee-compatible sniffer firmware
zbstumbler # find active Zigbee channels
zbdump -w capture.pcap # capture to a file, open in Wireshark
# BLE: flash the Nordic nRF Sniffer firmware, then select the dongle as
# the capture interface from Wireshark's extcap listOne stack at a time. The dongle needs different firmware for Zigbee sniffing versus BLE sniffing; flashing one erases the other.
Channel hopping. Both Zigbee and BLE spread across channels - miss the active one and the capture stays empty.