-9%
CatSniffer V3
A multiprotocol, multiband USB sniffer for authorized IoT security research: capture, analyze and interact with Zigbee, BLE, Thread and LoRa traffic from a single board.
Original price was: $150.00.$136.00Current price is: $136.00.
Out of stock
Email when stock available
- Wireshark — extcap plugin + Zigbee/Thread/LoRa dissectors
- Kismet — passive Zigbee wardriving, exports PCAP-NG
- Sniffle (NCC Group) — officially supported BLE sniffer
- Linux Bluetooth stack — shows up as an hciX adapter
In the box
CatSniffer V3 board
USB cable
USB cable
Not included
No battery — CatSniffer runs entirely off USB power, with no onboard battery in any version. The board and USB cable are already in the box.
You also need
A computer to flash firmware with the Catnip CLI before first use — it isn’t plug-and-play out of the box.
- 937 GitHub Stars
- DragonJARCON 2021 — conference talk: "CatSniffer la herramienta para Internet de las Cosas."
- Designed and built in Aguascalientes, Mexico
- Hardware CERN-OHL v1.2 · firmware GPL-3.0
Passive Zigbee Mapping and WIDS with Kismet
During an authorized building or urban IoT audit, flash the ti_sniffer firmware with catnip flash ti_sniffer and feed the serial port into Kismet as a catsniffer_zigbee datasource. Kismet renders live device and signal graphs, raises WIDS alerts for new devices, signal anomalies and lost devices, and — with GPS attached — supports Zigbee wardriving. Convert the capture to PCAP-NG with kismetdb_to_pcap and open it in Wireshark to inspect and decrypt ZCL commands.
CatSniffer as a Standard Linux Bluetooth Adapter
Run catnip vhci start and Catnip verifies — and flashes, if needed — the correct Sniffle firmware automatically, then exposes CatSniffer as a standard hciX kernel device. No custom scripts to learn: bluetoothctl, btmgmt, btmon, bettercap and Python’s bleak all work against it exactly as they would against any Bluetooth dongle. Sniffle is NCC Group’s BLE 5/4.x sniffer, and CatSniffer is one of its officially supported boards — no compiling the project yourself.
Your First Capture: Live BLE Traffic in Wireshark
It is your first session with a new CatSniffer V3, on Windows, macOS or Linux. Install Catnip’s native package, then run catnip once — it downloads the official firmware release and checks every file’s SHA256 checksum. Flash the protocol you want with catnip flash [alias], run catnip verify to confirm the board passes its hardware self-test, then catnip sniff [protocol]. Wireshark launches through the extcap integration if selected, and parsed BLE advertisement and connection packets scroll past.
Start in 10 minutes
- Install Catnip for your OS — native installers for Windows, macOS (Intel/Apple Silicon) and Linux (.deb/.pkg.tar.zst/AUR).
- Run
catniponce. On a clean environment it auto-downloads the latest official firmware release and verifies each file’s SHA256 checksum. - Run
catnip devicesto confirm the board is detected and see its three serial ports (Cat-Bridge, Cat-LoRa, Cat-Shell). - Run
catnip flash <alias>— for exampleble,zigbee,threadorlora-sniffer— to flash the matching firmware onto the CC1352. - Run
catnip verifyfor the hardware self-test, thencatnip sniff <protocol>to start capturing: Wireshark launches automatically through the extcap integration if selected. Full command reference in the CatSniffer wiki.
| Weight | 0.055 g |
|---|---|
| Dimensions | 18 × 12.5 × 2 cm |
| Bridge MCU | RP2040 dual-core Arm Cortex-M0+ @ 133MHz (USB-UART/USB-SPI bridge) |
| Radio MCU | TI CC1352P7, Arm Cortex-M4F @ 48MHz |
| LoRa Modem | Semtech SX1262 (170dB max link budget, -148dBm sensitivity) |
| Wireless Protocols | Thread, Zigbee, Matter, Bluetooth 5.2 Low Energy, IEEE 802.15.4g, 6LoWPAN, mioty, Amazon Sidewalk, Wireless M-Bus, Wi-SUN, LoRa/LoRaWAN |
| Program Flash | CC1352P7: 704KB in-system programmable; RP2040: up to 16MB off-chip via QSPI |
| SRAM / ROM | CC1352P7: 144KB ultra-low-leakage SRAM with parity + 8KB cache SRAM + 256KB ROM; RP2040: 264KB SRAM in six banks |
| Antenna Support | 433MHz up to 13dBm, 2.4GHz up to 10dBm |
| Bootloader | Automatic entry into the CC1352 TI bootloader — no external programmer needed for normal flashing |
| Debug & Recovery | cJTAG/JTAG on the CC1352 default pin; TagConnect 6-pin SWD connector for external J-Link/ST-Link recovery |
| Supported OS | Linux (full support), macOS (functional), Windows (compatible) |
| Firmware License | GNU AGPL v3.0 |
| Hardware License | CERN Open Hardware Licence v1.2 |
Both hardware generations are flashed and managed through the same Catnip CLI.
| Attribute | v1.x / v2.x | v3.x (current) |
|---|---|---|
| Bridge MCU | Microchip SAMD21E17 (USB-UART bridge) | Raspberry Pi RP2040, dual-core Arm Cortex-M0+ @ 133MHz |
| Radio MCU memory | CC1352P1: 352KB flash / 80KB SRAM | CC1352P7: 704KB flash / 144KB SRAM |
| Protocol / tooling support | Thread, Zigbee, BLE 5.2, 802.15.4g, 6LoWPAN, mioty, Wireless M-Bus, Wi-SUN, TI 15.4-Stack; Wireshark v3.0.x dissectors | Thread, Zigbee, Matter, BLE 5.2, Wi-SUN, mioty, Amazon Sidewalk, Wireless M-Bus, TI 15.4-Stack, 6LoWPAN; Wireshark v4.0.x dissectors |
| Antenna support | 868/915MHz up to 14dBm, 2.4GHz up to 20dBm | 433MHz up to 13dBm, 2.4GHz up to 10dBm |
What is the CatSniffer?
CatSniffer is a multiprotocol, multiband board in a portable USB-stick form factor for sniffing and communicating with IoT devices across LoRa, Sub-1GHz and 2.4GHz — Zigbee, BLE, Thread and 802.15.4 included. It pairs a TI CC1352P7 radio MCU with a Semtech SX1262 LoRa modem and an RP2040 bridge (V3.x). It is a flash-level device: firmware loads onto the CC1352 via the Catnip CLI before first use.
How can I use CatSniffer?
Flash the firmware for the protocol you want with Catnip — catnip flash ble, zigbee, thread or lora-sniffer — then run catnip sniff to capture; Wireshark opens through the extcap integration if selected. CatSniffer is a wireless penetration testing tool intended solely for authorized security audits where applicable law permits: confirm your legal footing and obtain proper authorization before capturing traffic on any network you do not own.
What IoT protocols are supported by CatSniffer?
The CC1352P7 radio covers Thread, Zigbee, Matter, Bluetooth 5.2 Low Energy, IEEE 802.15.4g, 6LoWPAN, mioty, Amazon Sidewalk, Wireless M-Bus and Wi-SUN, plus proprietary Sub-1GHz systems. A dedicated Semtech SX1262 modem adds LoRa and LoRaWAN sniffing and spectrum work, so one board spans Sub-1GHz and 2.4GHz without swapping hardware. Each protocol runs as its own firmware, flashed on demand via Catnip.
How can I restore the CC1352 firmware on CatSniffer?
Run catnip restore: it uses the onboard RP2040 as a CMSIS-DAP JTAG programmer, through OpenOCD, to reflash a bricked CC1352 — no external hardware required. If that path is unavailable, a SEGGER J-Link on the board’s Tag-Connect TC20X0-CLIP cable and 6-pin SWD connector reflashes it directly. Normal firmware updates need none of this: catnip flash [alias] handles those over the serial bootloader.
