Revision history  [back]

The ZigBee dissector expects the keys to be stored in a file called zigbee_pc_keys which should be located in your Wireshark personal preferences directory. If that file doesn't exist, then you'll have to create one.

The content and format of the file isn't documented (as far as I can tell) because it's expected that one would create it through Wireshark. If you can create it first through Wireshark, then that's probably the best and easiest way to do it; if not, you can try to create one on your own. I've never worked with ZigBee packets, but I created a sample file illustrating a few formats:

# This file is automatically generated, DO NOT MODIFY.
"\x221234567890123456\x22","Normal","Foo"
"00:11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff","Reverse","Bar"

The first column is the Key, specified as either 16 hexadecimal bytes or a 16 character double-quoted string, the second column is the Byte Order, specified as either "Normal" or "Reverse", and the third column is the Label.

Lastly, if you don't know the location of your personal configuration directory, you can either run tshark -G folders to find it, or the Wireshark man page provides some help under the FILES section:

The personal preferences file is looked for in $XDG_CONFIG_HOME/wireshark/preferences (or, if $XDG_CONFIG_HOME/wireshark does not exist while $HOME/.wireshark is present, $HOME/.wireshark/preferences) on UNIX-compatible systems and %APPDATA%\Wireshark\preferences (or, if %APPDATA% isn't defined, %USERPROFILE%\Application Data\Wireshark\preferences) on Windows systems.