electroniccats / catsniffer

CatSniffer is an original multiprotocol and multiband board for sniffing, communicating, and attacking IoT (Internet of Things) devices using the latest radio IoT protocols. It is a highly portable USB stick that integrates TI CC1352, Semtech SX1262, and an RP2040 for V3 or a Microchip SAMD21E17 for V2

CatSniffer

CatSniffer (:smirk_cat:) is an original multiprotocol, and multiband board made for sniffing, communicating, and attacking IoT (Internet of Things) devices. It was designed as a highly portable USB stick that integrates the new chips TI CC1352, Semtech SX1262, and an RP2040 for V3 or a Microchip SAMD21E17 for V2.

This board is a swiss army knife for IoT security researchers, developers, and enthusiasts. The board can be used with different types of software including third-party sniffers such as SmartRF Packet Sniffer, Sniffle, zigbee2mqtt, Z-Stack-firmware, Ubiqua Protocol Analyzer, our custom firmware, or you can even write your own software for your specific needs.

CatSniffer can operate in 3 different technologies:

• LoRa
• Sub 1 GHz
• 2.4 GHz

This work was inspired by our friend's work Michael Ossmann as a tribute to his outstanding job in Greatscott Gadgets, making devices like the YardStick, GreatFET, HackRF, and Ubertooth.

Versions

The CatSniffer has been evolving since its first release:

• CatSniffer v1.2
• CatSniffer v1.3
• CatSniffer v2.0
• CatSniffer v2.1
• CatSniffer v3.1

We as an pro-open-source companies decided to keep the support for each version, but having in mind that newer versions will have more features than the first versions.

The different firmwares are inside the repository and not in the realese section to keep a propper track of the compiled and source files.

Protocols

• Thread
• Zigbee
• Bluetooth 5 Low Energy (BLE)
• IEEE 802.15.4g
• 6LoWPAN (IPv6 over Low power Wireless Personal Area Networks)
• Sub 1Ghz and patented systems
• LoRa/LoRaWAN
• Wi-SUN
• Amazon Sidewalk
• mioty®

Features

• "The SimpleLink™ CC1352P1F3RGZ device is a multiprotocol and multi-band Sub-1 GHz and 2.4-GHz wireless microcontroller (MCU) supporting Thread, Zigbee®, Bluetooth® 5.2 Low Energy, IEEE 802.15.4g, IPv6-enabled smart objects (6LoWPAN), MIOTY®, Wi-SUN®, proprietary systems".
• CatSniffer uses Microchip SAMD21E17 (V2 or previous) and RP2040 (V3 or later) as a USB-UART bridge to communicate with the CC1352 chip; it's not necessary for a manual driver installation (exceptions could exist).
• Compatible OS: Windows and Linux.
• Auto program through the bootloader from TI CC (as long as it's not disabled in the code). No need for an external programmer, and it can be debugged with cJTAG through the default pin.
• Antenna SMA port for an Antenna of your choice.
• LEDs of general-purpose.
• Reset button for RP2040, SAMD21 & CC1352, Boot of CC1352, and one more for general purpose.

Wiki and Getting Started

Getting Started in our Wiki

Firmware Repository

All Catsniffer Firmware has been moved to a different repository, to have a better version control, and issue tracking you will find it here:

https://github.com/ElectronicCats/CatSniffer-Firmware

All catsniffer versions are supported in this repository, you will need to check what version you own and select the proper branch to develop or release for just program your board.

Software Repository

All Catsniffer Software has been moved to a different repository, to have a better version control, and issue tracking you will find it here:

https://github.com/ElectronicCats/CatSniffer-Tools

Compatible Software

• Smart RF Packet Sniffer 2
• Wireshark
• pycatsniffer tool (BETA)
• Sniffle
• Ubiqua Protocol Analyzer
• zigbee2mqtt
• Z-Stack-firmware

Pre-requisites for building firmware

• Arduino IDE for RP2040 or SAMD21E17
• CCS version: The packet sniffer firmware has been tested with CCS 10.2
• SimpleLink CC13x2 and CC26x2 SDK
• Python 3

Note

This kit is designed to allow Product developers to evaluate electronic components, circuit, or software associated with the kit to determine whether to incorporate such items in a finished product and Software developers to write software applications for use with the end product. This kit is a developer product and when assembled may not be resold or otherwise marketed unless all required FCC (or any other local authority) equipment authorizations are first obtained. Operation is subject to the condition that this product not cause harmful interference to licensed radio stations and that this product accept harmful interference.

Workshops

We have been doing worshops held in different security related events the material avaible is public and can be found here

How to contribute

Contributions are welcome!

Please read the document Contribution Manual which will show you how to contribute your changes to the project.

✨ Thanks to all our contributors! ✨

See Electronic Cats CLA for more information.

See the community code of conduct for a vision of the community we want to build and what we expect from it.

License

Electronic Cats invests time and resources providing this open source design, please support Electronic Cats and open-source hardware by purchasing products from Electronic Cats!

Designed by Electronic Cats.

Firmware released under an GNU AGPL v3.0 license. See the LICENSE file for more information.

Hardware released under an CERN Open Hardware Licence v1.2 See the LICENSE_HARDWARE file for more. Electronic Cats is a registered trademark, please do not use if you sell these PCBs.

3 April 2021

catsniffer's Issues

CC1352 and LoRa compatibility

Hi Electronic Cats (@Liars126) !

I recently came across your CatSniffer, which is a pretty handy device!

I am currently doing some research on LoRa compatible MCUs and officially it seems as though TI does not support LoRa. However, I also read that the CC1352 (which you guys are using) supports Amazon Sidewalk, which is based on LoRa (perhaps only the protocol?).

For the CatSniffer, I assume you use the Semtech SX1262 for LoRa, but since you are also familiar with the CC1352, do you perhaps know if this MCU is somehow compatible with the LoRa PHY?

Thanks in advance!

Best regards,
Reinier

Catsniffer not detected by PC - Windows 10

Hi, so I ordered a V2 Catsniffer in July this year and due to a work move have only recently taken it out of the bag.

I'm hoping to use it on a Windows 10 laptop with TI Packet Sniffer software. Have downloaded V1.8.

But, when I connect the Catsniffer via the USB lead to the PC it isn't detected and doesn't show in device manager.

Having read other issues I saw that Win8 had issues which had been solved by Zadig so downloaded that but Zadig doesn't see the CS either.

I have also tried to communicate with the board using the Arduino IDE but it doesn't show on that.

That said, when I plug it in I get a slow flash on led D4 so it is powering up and I think I can put it into bootloader mode by holding boot switch and applying power then releasing boot switch and led doesn't flash.

Can you think of a way to get the laptop to see the device?

ElectronicCats

Hello I just received my catsniffer today . I have 40 years of computers stall knowledge and the same in radio reception.

I don't know how to begun

Under windows 10 , my catsniffer is recognize as com 3 but no led are lighting
I tried to push all buttons as described in documentation -- no chance

I have plenty of windows, linux , raspi computers all kind of versions

I installed the arduino IDE on a raspi 4 using dragon OS v31 (ubuntu) trying to communicate with catsniffer

I have error in running Arduino 1.8.19 like 👍

Arduino: 1.8.19 (Linux), Board: "Arduino Uno"

/tmp/arduino_modified_sketch_710303/sketch_sep25a.ino: In function 'void setup()':
sketch_sep25a:68:3: error: 'Serial1' was not declared in this scope
Serial1.begin(baud);
^~~~~~~
/tmp/arduino_modified_sketch_710303/sketch_sep25a.ino:68:3: note: suggested alternative: 'Serial'
Serial1.begin(baud);
^~~~~~~
Serial
/tmp/arduino_modified_sketch_710303/sketch_sep25a.ino: In function 'void loop()':
sketch_sep25a:91:5: error: 'Serial1' was not declared in this scope
Serial1.write(Serial.read()); // read it and send it out Serial1 (pins 0 & 1)
^~~~~~~
/tmp/arduino_modified_sketch_710303/sketch_sep25a.ino:91:5: note: suggested alternative: 'Serial'
Serial1.write(Serial.read()); // read it and send it out Serial1 (pins 0 & 1)
^~~~~~~
Serial
sketch_sep25a:94:7: error: 'Serial1' was not declared in this scope
if (Serial1.available()) { // If anything comes in Serial1 (pins 0 & 1)
^~~~~~~
/tmp/arduino_modified_sketch_710303/sketch_sep25a.ino:94:7: note: suggested alternative: 'Serial'
if (Serial1.available()) { // If anything comes in Serial1 (pins 0 & 1)
^~~~~~~
Serial
exit status 1
'Serial1' was not declared in this scope

This report would have more information with
"Show verbose output during compilation"
option enabled in File -> Preferences.

---

Can you explain the way to use catsniffer in windows 10 with TI packets sniffer

is there any different firmware for different applications ?

What is the exact way to start catsniffer

1- serial passthrough ? how ?
2- serial passthrough with bootloader ?

-- using sniffe ? how ? different firmware ?

Thanks for help

ElectronicCats - Bricked Card? Wrote incorrect version of firmware

Flashing failed to verify, stuck.

Board v2.0 - Linux & Windows

Steps to flash

• Flash arduino serialtoboot
• Successfully got to step in python flash where it says to press reset after testing the port.
• Pressed reset, next command failed with the ACK/Synch error.
• Entered flash mode again manually with button combo
• Performed the command with the sniffer_fw.hex in the 1352r bin folder (the name in the docs doesn’t exist in the repo).
• Erased and flashed, verifying then ERROR timeout waiting after Get CRC32
• Led 2 now flashes whenever connected and it won’t go back into flash or boot mode.
• Holding boot and plugging it in causes all 4 leds to blink in succession.

Did I brick it already?

ElectronicCats

Hello

I'm very happy with catsniffer . I succeed with TI RF sniffer with BLE and Zigbee . I did find any explaination of the differents modes in TI sniifer except BLE and zigbee . Can I have the translation between list in TI sniffer and protocol .

IEEE 802.15.4g - GFSK 50 Kbps - 915 MHz - Freq Band
spacing 0,2 channel Range 0-128 Channel 0 Frequency 902,2
IEEE 802.15.4g - GFSK 50 Kbps - 868 MHz - Freq Band
spacing 0,2 channel Range 0-33 Channel 0 Frequency 863,125
IEEE 802.15.4g - GFSK 50 Kbps - 433 MHz - Freq Band
spacing 0,2 channel Range 0-6 Channel 0 Frequency 433,3

IEEE 802.15.4g - SimpleLink™ Long Range Mode 5kpps - 915 MHz - Freq Band
spacing 0,2 channel Range 0-128 Channel 0 Frequency 902,2
IEEE 802.15.4g - SimpleLink™ Long Range Mode 5kpps - 868 MHz - Freq Band
spacing 0,2 channel Range 0-33 Channel 0 Frequency 863,125
IEEE 802.15.4g - SimpleLink™ Long Range Mode 5kpps - 433 MHz - Freq Band
spacing 0,2 channel Range 0-6 Channel 0 Frequency 433,3

IEEE 802.15.4g - GFSK 50 Kbps Wi-SUN PHY #1a (ID 1)- 868 MHz - Freq Band
spacing 0,1 channel Range 0-128 Channel 0 Frequency 863,1 MHz base frequency 863,1 MHz
IEEE 802.15.4g - GFSK 50 Kbps Wi-SUN PHY #1b (ID 2)- 915 MHz - Freq Band
spacing 0,2 channel Range 0-128 Channel 0 Frequency 902,2 MHz base frequency 902,2 MHz
IEEE 802.15.4g - GFSK 100 Kbps Wi-SUN PHY #2a (ID 3)- 868 MHz - Freq Band
spacing 0,2 channel Range 0-128 Channel 0 Frequency 863,1 MHz base frequency 863,1 MHz
IEEE 802.15.4g - GFSK 100 Kbps Wi-SUN PHY #2b (ID 4)- 915 MHz - Freq Band
spacing 0,2 channel Range 0-128 Channel 0 Frequency 902,2 MHz base frequency 902,2 MHz
IEEE 802.15.4g - GFSK 150 Kbps Wi-SUN PHY #3 (ID 5)- 868 MHz - Freq Band
spacing 0,2 channel Range 0-128 Channel 0 Frequency 863,1 MHz base frequency 863,1 MHz
IEEE 802.15.4g - GFSK 200 Kbps Wi-SUN PHY #4a (ID 6)- 915 MHz - Freq Band
spacing 0,4 channel Range 0-128 Channel 0 Frequency 902,4 MHz base frequency 902,4 MHz
IEEE 802.15.4g - GFSK 200 Kbps Wi-SUN PHY #4b (ID 7)- 915 MHz - Freq Band
spacing 0,6 channel Range 0-128 Channel 0 Frequency 902,8 MHz base frequency 902,8 MHz
IEEE 802.15.4g - GFSK 100 Kbps Zigbee R23- 868 MHz - Freq Band
spacing 0,2 channel Range 0-128 Channel 0 Frequency 863,1 MHz base frequency 863,1 MHz
IEEE 802.15.4g - GFSK 500 Kbps Zigbee R23- 868 MHz - Freq Band
spacing 0,2 channel Range 0-128 Channel 0 Frequency 863,1 MHz base frequency 863,1 MHz
Canal 0 : 868 MHz (Europe)
IEEE 802.15.4g - GFSK 200 Kbps - 915 MHz - Freq Band
spacing 0,4 channel Range 0-63 Channel 0 Frequency 902,4

Generic GFSK 50 Kbps - 868 MHz - Freq Band
spacing channel Range Channel Frequency 863,125
Generic GFSK 50 Kbps - 433 MHz - Freq Band
spacing channel Range Channel Frequency 433,3

Generic SimpleLink™ Long Range Mode 5kpps 868 MHz
spacing channel Range Channel Frequency 863,125 MHz

Generic SimpleLink™ Long Range Mode 5kpps 433 MHz
spacing channel Range Channel Frequency 433,3 MHz

IEEE 802.15.4 O-QPSK - 2405 MHz Freq Band
spacing 5,0 channel Range 11-26 Channel 11 Frequency 2405,0 MHz
zigbee

BLE - BLE 1 Mbps - 2402 - Freq Band
spacing 2,0 channel Range 37-39 Channel 37 Frequency 2402,0 MHz

---

How snif lora and LORAWAN . I have in France a lora gateway on 433.775 MHz and I don't know how to set this . Is it a particular firmware or python tools ?

Thanks

Windows 11 Issue?

Hello,

I am trying to setup the SmartRF Packet Sniffer 2 with catsniffer. I can see the serial device in the control panel, but the Device configuration button on SmartRF is grayed out and the device cannot be detected. I had the latest version, but now I am on 1.8.0 of smartRF. I tried many things (I also have the SDK installed) but nothing worked. Anyone solved this issue?

Thanks

Wrong image path

The part of wireshark.md can't show the images cause' don't have a properly image path in the files
The issues are in ElectronicCats/CatSniffer/docs/wireshark.md

RP2040 SerialPassThrough vs withboot Question

My question is in regards to the v3.1. It would appear that after loading the SerialPassThroughwithBoot that each time I plug in the CatSniffer I now have each outer blue light blinking vs when it was first sent to me I had one light blinking.

Since I now also understand the CatSniffer v3.1 came from the factory loaded with firmware (which one?) and that I've not been able to successfully load an alternate firmware due to to the inability to get bootloader mode, it would seem to me that I more then likely still have the original factory firmware on it.

So with this in mind, I thought I should maybe load back onto the RP2040 the original SerialPassThrough and return to how it was from the factory, or does that matter? There's no .uf2 file provided in the SerialPassThrough folder, but I can see the arduino directions. Is the intent to leave the SerialPassThroughwithboot loaded on the RP2040? With this loaded and two blinking lights, is the CatSniffer still ready to use with some applications in linux so long as the original firmware is still in place?

SmartRF can't detect CatSniffer

SmartRF can't detect CatSniffer, is there any troubleshoot script? How can I check if the hardware (bought at DEFCON30) is fine?

I've tried some firmware scripts just to check the communication:

I've changed the timeout on the python script :

I'm switched from MacOS to an Windows 8 on Parallels ... and the drivers seems to haven't been installed:

Missing documentation

This project is really hard to get started with.

The github contains a lot of firmwares and 3d Prints files but not really any informations of how to install the firmware and use the stick.

Could you make a quick-start guide - i am running Linux and bought this stick because it was linux compatible but have still not figured out how to get it up and running - wireshark plugins is only for windows :/

Software support for Linux

We apologize for any inconvenience you've faced while trying to use our devices on Linux. We truly value your feedback and understand the importance of having a seamless experience across different operating systems, especially in field applications.

No need to apologize. The product is great, but its capabilities are limited behind the TI & Windows hobbyist environment requiring deprecated versions. Serial output should be standard, so at the least we can see what the sniffer sees as referenced in the workshop BLE spoof/sniff modules.

Sniffle is a mess to compile, then doesn’t seem to work. And your docs tell us if we want to use pre-compiled builds the only way is with Uniflash which doesn’t work on most Linux distributions.

I’ve gotten it to show airtags, but disheartening was the fact that an app on my phone did the same and found an equal amount.

Is a new plugin/script for wireshark possible to solve this? Has anyone found anything that works with this device?

Lastly, does the device need the serial pass though flashed to see the output of the AirTag fw from the CC chip? Any help appreciated. Thanks all.

PyCatSniffer + Wireshark not working on MacOS

Describe the problem:
When trying to capture BLE ADV packets on MacOS with PyCatSniffer no packets are shown.

To Reproduce:

1. Entered the CatSniffer board into bootloader by holding BOOT1 + Press and Release RESET 1 + Release BOOT1

• Tried copying SerialPassthroughwithboot.ino.elf.uf2 to RPI-RP2 before entering bootloader mode and without the SerialPassthrough

2. When LEDs were blinking in waterfall mode, I proceeded to flash the firmware

On MacOS flashed the firmware using catnip:

❯❯❯ python3 catnip_uploader.py releases
Releases available:
0: airtag_scanner_CC1352P_7.hex
1: airtag_spoofer_CC1352P_7.hex
2: sniffer_fw_CC1352P_7.hex
3: sniffle_CC1352P_7.hex

❯❯❯ python3 catnip_uploader.py load 2 /dev/cu.usbmodem14401
[...]
Connecting to target...
CC1350 PG2.0 (7x7mm): 704KB Flash, 20KB SRAM, CCFG.BL_CONFIG at 0x000AFFD8
Primary IEEE Address: 00:12:4B:00:2A:79:C0:94
    Performing mass erase
Erasing all main bank flash sectors
    Erase done
Writing 720896 bytes starting at address 0x00000000
Write 208 bytes at 0x000AFF308
    Write done
Verifying by comparing CRC32 calculations.
    Verified (match: 0x52c24bf8)
Done uploading sniffer_fw_CC1352P_7.hex to /dev/cu.usbmodem14401

3. Installed Wireshark dissectors by copying the content of:

.dissectors:
├── catsniffer-blepi.lua
├── catsniffer-register.lua
└── catsniffer-rpi.lua

to the Personal LUA Plugins Path on Wireshark. For MacOS it was: $HOME/.local/lib/wireshark/plugins

4. Configured the DLT 147 value

5. Ran cat_sniffer.py

❯❯❯  python3 cat_sniffer.py sniff /dev/cu.usbmodem14401 -phy 0 -ch 37 -pf -pfn catsniffer.pcap -df -ff -ws
[...]
PyCat-Sniffer CLI - For sniffing the TI CC1352 device communication interfaces.
Type help or ? to list commands.

PycatSniffer CLI> 2024-01-25 13:49:01.709 Wireshark[73878:8530619] WARNING: Secure coding is not enabled for restorable state! Enable secure coding by implementing NSApplicationDelegate.applicationSupportsSecureRestorableState: and returning YES.
 ** (wireshark:73878) 13:49:04.823974 [GUI WARNING] -- Populating font family aliases took 123 ms. Replace uses of missing font family "SF Mono" with one that exists to avoid this cost.
 ** (wireshark:73878) 13:49:05.148722 [Capture MESSAGE] -- Capture Start ...

Expected behavior:
BLE packets being captured on Wireshark/CatSniffer

Screenshots:

Additional context:
Also tried on a VM Linux using the same methods to flash the board, and a Windows VM with SmartRF Packet Sniffer (uploaded SerialPassthroughwithboot.ino in this case as the wiki says)

• For Linux VM I got the same behavior as with MacOS
• For Windows VM, the SmartRF Packet Sniffer is not able to detect the CatSniffer board

I tried to capture Flipper Zero BLE spam attack packages and starting pairing mode on IoT devices.

Tested environment

• MacOS Sonoma 14.0 (23A344)
• VM Kali Linux 6.0.0-kali3-amd64
• VM Windows 10 x64

Can't flash CC1352

Hi.
Catsniffer isn't recognized in the Smart RF Sniffer 1.9 (already read and applied advice from FAQ wiki GitHub page - still no result). When I try to flash the firmware of the 1352 - nothing happens. I can upload "Serial Passthrough with bootloader", but
Flash Programmer 2 doesn't see the device and when I try to flash with python I get the error " Timeout waiting for ACK/NACK after 'Synch (0x55 0x55)". Also when I try to enter the bootloader through hardware first press the “boot” button and while holding it, press and release "reset", and finally release the “boot” button - nothing happens, it didn't work and No LED activity. Tried to run on three different computers, used different USB cables - nothing helps.

Failed to flash a new firmware.

Hello,

I am trying to change the firmware of the CC1352.

I have succesfully loaded the sketch "Serial Passthrought with Bootloader" into the CatSniffer.

Also, I did the procedure to enter into bootloader by power off -- pressing boot button -- and then power on again. It didn't work and no LED activity.

I have noticed that CC1352 continues sending a message by UART (received by the serial passthorugh with boot) after it is supposed to be in a bootloader mode, so I think that CC1352 doesn't enter into bootloader.

The following is the received message, this is the same as when the Sniffer Firmware is working:

Note: I changed the baudrate in the bootloader sketch just to be sure that CC1352 is sending the same announcement, but also tried with 500000. Changed to 500000, the message is also arriving but it is not readable:

I have been trying since I received the CatSniffer but never been acomplished. I have tried with TI and Python tools but since CatSniffer is not in bootloader mode that tools doesn't work.

According to the CC13x2, CC26x2 SimpleLink Wireless MCU Technical Reference Manual, the baudrate of UART for bootloader can be synchoronized by sending 0x55 0x55. The answer to this bytes, are the same, the announcement message.

The CatSniffer is working well with the stock firmware.

Feedback (CatSniffer v2)

Received a CatSniffer over the weekend and wanted to share some notes while they're fresh.

Found my way to here after finding mention in another closed ticket
https://github.com/ElectronicCats/CatSniffer/wiki/02.-Flashing-firmwares-(CatSniffer-v1.x-and-2.x)

Attempted to get to bootloader mode on the CC1352 using the hardware method and 22.04, but after making double sure I was pushing the right button combo I always ended up getting back to one flashing light and the following (mentioned in another closed ticket)

Opening port /dev/ttyACM0, baud 500000
Connecting to target...
ERROR: Timeout waiting for ACK/NACK after 'Synch (0x55 0x55)'

I then grabbed the Arduino IDE and followed the software steps, uploaded the sketch that I finally found here (wiki doesn't say exactly where to find it)
https://github.com/ElectronicCats/CatSniffer/tree/master/firmware/V1.x_V2.x/SAMD21E17/SerialPassthroughwithboot

At which point I was able to perform the following, while not certain of the firmware version as it doesn't match what the wiki says

python3 cc2538-bsl.py -e -w -v -p /dev/ttyACM0 /home/dragon/Downloads/CatSniffer/firmware/V1.x_V2.x/CC1352P2/TI_PACKET_SNIFFER/sniffer_fw/bin/cc1352p1lp/sniffer_fw.hex

The one blue light blinks, but what I notice is that after unplugging and plugging back in no lights blink and it's essentially needing me to reflash the hex file.

pycatsniffer.py seems to run, but there's no results.

Is there a newer/more clear set of steps to follow when going from brand new to operation? There was one light blinking on it when I took it out of the bag, but pycatsniffer.py did not seem to work and would just hang. Surely I'm missing something here.

(Request) RemoteID Sniffing and Decoding Bluetooth

I think perhaps decoding RemoteID per the most recent standard required on US/Europe drones would be handy if accomplished by CatSniffer.

I was reading over this link,
https://github.com/opendroneid/opendroneid-core-c?tab=readme-ov-file

And this caught my attention under this section
https://github.com/opendroneid/opendroneid-core-c?tab=readme-ov-file#bluetooth-sniffing

“ Using Texas Instruments Bluetooth boards, it should be possible to use this SW to pick up all Bluetooth advertisements from a transmitter: https://github.com/nccgroup/Sniffle “

It may just be a matter of using CatSniffer, Sniffle, and the Wireshark dissectors from the link above. I see CatSniffer is up to what appears to be 1.7 Sniffle and I recall in the past being able to get the Wireshark Sniffle connection working.