IEEE 802.15.4 Sniffer

The IEEE 802.15.4 Sniffer listens to a selected IEEE 802.15.4 channel (2.4GHz O-QPSK with DSSS) and integrates with the nRF 802.15.4 sniffer extcap for Wireshark.


The sample supports the following development kits:

Hardware platforms


Board name

Build target

nRF5340 DK




nRF52840 Dongle




nRF52840 DK




The application can be used with the nRF Sniffer for 802.15.4 extcap utility for the Wireshark network protocol analyzer.


The application presents the user with a command-line interface.

See the Serial commands list for the list of the available commands.

LED 1:

When the capture is stopped the LED blinks with a period of 2 seconds with 50% duty cycle. When the capture is ongoing the LED blinks with a period of 0.5 seconds with 50% duty cycle.

LED 4:

When the sniffer captures a packet the LED is toggled on and off.

Serial commands list

This section lists the serial commands that are supported by the sample.

channel - Change the radio channel

The command changes the IEEE 802.15.4 radio channel to listen on.

channel <channel>

The <channel> argument is an integer in the range between 11 and 26.

For example:

channel 23

receive - start capturing packets

The receive command makes the sniffer enter the RX state and start capturing packets.


The received packets will be printed to the command-line with the following format:

received: <data> power: <power> lqi: <lqi> time: <timestamp>
  • The <data> is a hexidecimal string representation of the received packet.

  • The <power> value is the signal power in dBm.

  • The <lqi> value is the IEEE 802.15.4 Link Quality Indicator.

  • The <timestamp> value is the absolute time of the received packet since the sniffer booted.

sleep - stop capturing packets

The sleep command disables the radio and ends the receive process.



See Configuring your application for information about how to permanently or temporarily change the configuration.

Building and running

This sample can be found under samples/peripheral/802154_sniffer in the nRF Connect SDK folder structure.

To build the sample with Visual Studio Code, follow the steps listed on the How to build an application page in the nRF Connect for VS Code extension documentation. See Building and programming an application for other building and programming scenarios and Testing and debugging an application for general information about testing and debugging in the nRF Connect SDK.

Testing the sample

After programming the sample to your development kit, complete the following steps to test it:

  1. Connect the development kit to the computer using a USB cable. Use the development kit’s nRF USB port (J3). The kits are assigned a COM port (in Windows) or a ttyACM device (in Linux), visible in the Device Manager or in the /dev directory.

  2. Connect to the kit with a terminal emulator (for example, PuTTY). See How to connect with PuTTY for the required settings.

  3. Switch to a radio channel with an ongoing radio traffic:

    channel 23
  4. Start the capture process:


    The LED 1 will start blinking with shorter intervals.

  5. If there is radio traffic on the selected channel, the sniffer should print the captured packets:

    received: 49a85d41a5fffff4110f10270000369756e65619d09428a04b301951821db234460aa5ec4ff506631ef8adb22674683700 power: -39 lqi: 220 time: 15822687

    The LED 4 will toggle its state when a frame is received.

  6. Disable the capture:


    The LED 1 will start blinking with longer intervals.


This sample uses the following sdk-nrfxlib libraries:

This sample uses the following nRF Connect SDK libraries:

This sample uses the following Zephyr libraries:

  • Kernel Services:

    • include/zephyr/kernel.h

    • include/zephyr/sys/util.h

  • IEEE 802.15.4:

    • include/zephyr/net/ieee802154_radio.h

  • Shell:

    • include/zephyr/shell/shell.h

    • include/zephyr/shell/shell_uart.h