In my previous post, we looked at sniffing Zigbee traffic using the older TI CC2531 🛒Affiliate Link: I may receive a small commission at no extra cost to you when you buy via this link. A way to support my work.. While great for learning, it’s not the hardware you want running your actual home. The CC2531 is excellent for sniffing because it simply runs the sniffer firmware—that is what I used it for, and that is what I will keep using it for.

In my previous post, I explored using the nRF52840 nice!Nano for dual-duty BTLE and Zigbee sniffing. While the BTLE side worked like a charm, the Zigbee side remained stubbornly silent in Kismet and Wireshark.

To rule out firmware or hardware limitations, I decided to go with a classic: the Texas Instruments CC2531 USB Dongle 🛒Affiliate Link: I may receive a small commission at no extra cost to you when you buy via this link. A way to support my work..

The World in Miniature

Like many kids of my generation, I spent countless hours in the world of analog model railroading. But for me, it wasn’t just about watching a locomotive circle a loop of track. The real magic was in the creation: assembling plastic house kits, meticulously crafting terrain, and the complex “under-the-table” work of wiring up lights and electromagnetic turnouts. It was my first introduction to engineering and project management, though I didn’t know it then.

In my previous posts, we’ve journeyed through the process of Bridging the Gap: Bringing Modern Kismet to OpenBSD and had some Fun with RTL-SDR on OpenBSD tracking planes and smart meters. Today, I’m diving deeper into the invisible signals surrounding us by shifting our focus to Bluetooth Low Energy (BTLE) and Zigbee.

I’ve always been curious about what IoT devices around me are actually saying “behind my back” - fitness trackers, smart lightbulbs, and even toothbrushes are constantly “advertising” their presence. In this post, we will look at how to set up a professional-grade sniffing environment on OpenBSD using both the classic Adafruit Bluefruit Sniffer (nRF51822) and the modern nRF52840 (specifically the nice!nano).

Following up on my previous post about Bridging the Gap: Bringing Modern Kismet to OpenBSD, it is time to explore the hardware that makes much of this wireless exploration possible. If you have a spare USB port and a €50 RTL-SDR dongle, you can turn your OpenBSD box into a powerful radio scanner.

What is SDR?

Software Defined Radio (SDR) shifts the heavy lifting of radio signal processing from dedicated hardware circuits to software. Traditionally, if you wanted to listen to a new frequency or decode a new protocol, you needed a specific physical radio. With SDR, the hardware is simply a “dumb” front-end that digitizes a chunk of the RF spectrum; your CPU handles the demodulation and decoding.

For years, OpenBSD was stuck in a technical time-warp. While the rest of the world moved to Kismet “Newcore” - with its powerful web-based UI, distributed capture, and multi-protocol support—the OpenBSD port remained anchored to the legacy ncurses version.

The core software, with some small patches, compiled fine, but there was a massive void: no Wifi capture driver for OpenBSD. To move forward and finally retire the ancient version, I had to build the engine: capture_openbsd_wifi.