OnAirIoT & sensors · Experimental
Decode Zigbee / 802.15.4 with an SDR
OnAir receives Zigbee / 802.15.4. Zigbee and IEEE 802.15.4 on the 2.4 GHz channels 11 - 26 (O-QPSK, 2 Mchip/s, 250 kbit/s): networks (PAN ID, extended PAN ID, coordinator), devices with vendor from the address, MAC / NWK / APS headers, beacons and commands, a live frame log; channel scan. Receive only: encrypted payloads are not decrypted (the network key is not obtainable), only frames sent in the clear are shown. Needs a fast radio (4 Msps or more), not an RTL-SDR.
What Zigbee / 802.15.4 is
Zigbee and other 802.15.4 networks on 2.4 GHz carry smart-home and sensor traffic on channels 11 to 26.
Frequencies and where it is used
2.4 GHz channels 11 - 26 (O-QPSK, 2 Mchip/s, 250 kbit/s), one channel at a time or scanning all, 4 Msps (needs a fast radio: not an RTL-SDR).
In OnAir the tuning shortcut is IoT, 2.4 GHz; you can enter any frequency your radio reaches.
What OnAir shows for Zigbee / 802.15.4
Networks (PAN ID, extended PAN ID, coordinator, devices, level), a device list with the vendor from the extended address, a live frame log (MAC, Zigbee NWK and clear APS headers, beacons, association and other MAC commands, FCS checked) and a frames-per-second plot. Receive only: encrypted payloads are not decrypted (the network key is not obtainable here), only frames sent in the clear are shown in full.
This receiver is built from the published specification and checked end to end on simulated signals. It has had little or no testing on real transmissions yet, so reports and recordings on Discord are welcome.
Which radio you need
This mode sits at a high frequency, so check that your radio tunes it: a HackRF covers 1 MHz to 6 GHz, and RTL-SDR stops near 1.7 GHz. Some modes at these frequencies also need a fast radio (10 to 20 Msps) or a dish and an LNB.
Questions about Zigbee / 802.15.4
Can I decode Zigbee / 802.15.4 with an RTL-SDR?
Probably not: an RTL-SDR tunes up to about 1.7 GHz. A HackRF (1 MHz to 6 GHz) or another wideband radio is the usual choice for this frequency range.
Is it legal to receive Zigbee / 802.15.4?
This mode is passive. It only receives, never connects, pairs or joins networks, and never decrypts payloads. Check the rules where you live.
Can I try Zigbee / 802.15.4 in OnAir without a radio?
Yes. Most modes include a built-in synthetic test signal, so you can open the screen and try the controls before you own a radio.
Try it without a radio
OnAir includes built-in synthetic test signals for most modes, so you can open this screen, see the layout and try the controls before you own a radio. The Tour button walks you through the app.