0
$0.00
0

Cart

Zoom
CatSniffer
CatSniffer
CatSniffer
CatSniffer
CatSniffer
CatSniffer
CatSniffer
CatSniffer
CatSniffer
CatSniffer
CatSniffer
CatSniffer
CatSniffer
CatSniffer

CatSniffer V3

A multiprotocol, multiband USB sniffer for authorized IoT security research: capture, analyze and interact with Zigbee, BLE, Thread and LoRa traffic from a single board.

$136.00

In stock

  • Wireshark — extcap plugin + Zigbee/Thread/LoRa dissectors
  • Kismet — passive Zigbee wardriving, exports PCAP-NG
  • Sniffle (NCC Group) — officially supported BLE sniffer
  • Linux Bluetooth stack — shows up as an hciX adapter

In the box

CatSniffer V3 board
USB cable

Not included

No battery — CatSniffer runs entirely off USB power, with no onboard battery in any version. The board and USB cable are already in the box.

You also need

A computer to flash firmware with the Catnip CLI before first use — it isn’t plug-and-play out of the box.
  • 956 GitHub Stars
  • DragonJARCON 2021 — conference talk: "CatSniffer la herramienta para Internet de las Cosas."
  • Designed and built in Aguascalientes, Mexico
  • Hardware CERN-OHL v1.2 · firmware AGPL-3.0

What is CatSniffer?

CatSniffer is a multiprotocol, multiband IoT security research board in a portable USB-stick form factor, built for authorized sniffing and analysis of wireless traffic across Zigbee, Bluetooth Low Energy, Thread, LoRa, and Sub-1GHz protocols. It pairs a TI CC1352P7 multiprotocol radio MCU with a Semtech SX1262 LoRa modem and an RP2040 bridge, giving a single board coverage from Sub-1GHz up through 2.4 GHz. The Catnip CLI manages firmware flashing and drives protocol sniffing with native Wireshark and Kismet integration, running on Linux, macOS, and Windows. CatSniffer is designed solely for authorized security audits on networks and devices you own or have explicit permission to test.

Passive Zigbee Mapping and WIDS with Kismet

During an authorized building or urban IoT audit, flash the ti_sniffer firmware with catnip flash ti_sniffer and feed the serial port into Kismet as a catsniffer_zigbee datasource. Kismet renders live device and signal graphs, raises WIDS alerts for new devices, signal anomalies and lost devices, and — with GPS attached — maps where each Zigbee device was seen. Convert the capture to PCAP-NG with kismetdb_to_pcap and open it in Wireshark to inspect the ZCL commands.

CatSniffer as a Standard Linux Bluetooth Adapter

Run catnip vhci start and Catnip verifies — and flashes, if needed — the correct Sniffle firmware automatically, then exposes CatSniffer as a standard hciX kernel device. No custom scripts to learn: bluetoothctl, btmgmt, btmon, bettercap and Python’s bleak all work against it exactly as they would against any Bluetooth dongle. Sniffle is NCC Group’s BLE 5/4.x sniffer, and CatSniffer is one of its officially supported boards — no compiling the project yourself.

Run a Hands-On Wireless Sniffing Lab or Class

You are running a hands-on IoT wireless lab or class on networks you are authorized to monitor. Each station installs Catnip for Windows, macOS or Linux, runs catnip once to fetch the SHA256-checked firmware, and catnip verify to pass the hardware self-test. Students then run catnip flash ble and catnip sniff ble and watch live BLE traffic in Wireshark, following the public Hackster guide “Getting Started: CatSniffer V3 with Wireshark”. The “Kismet and CatSniffer” tutorial is the next exercise: passive Zigbee mapping.

Start in 10 minutes

  1. Install Catnip for your OS — native installers for Windows, macOS (Intel/Apple Silicon) and Linux (.deb/.pkg.tar.zst/AUR).
  2. Run catnip once. On a clean environment it auto-downloads the latest official firmware release and verifies each file’s SHA256 checksum.
  3. Run catnip devices to confirm the board is detected and see its three serial ports (Cat-Bridge, Cat-LoRa, Cat-Shell).
  4. Run catnip flash <alias> — for example ble, zigbee, thread or lora-sniffer — to flash the matching firmware onto the CC1352.
  5. Run catnip verify for the hardware self-test, then catnip sniff <protocol> to start capturing: Wireshark launches automatically through the extcap integration if selected. Full command reference in the CatSniffer wiki.
Weight0.055 g
Dimensions18 × 12.5 × 2 cm
Bridge MCU

RP2040 dual-core Arm Cortex-M0+ @ 133MHz (USB-UART/USB-SPI bridge)

Radio MCU

TI CC1352P7, Arm Cortex-M4F @ 48MHz

LoRa Modem

Semtech SX1262 (170dB max link budget, -148dBm sensitivity)

Wireless Protocols

Thread, Zigbee, Matter, Bluetooth 5.2 Low Energy, IEEE 802.15.4g, 6LoWPAN, mioty, Amazon Sidewalk, Wireless M-Bus, Wi-SUN, LoRa/LoRaWAN

Program Flash

CC1352P7: 704KB in-system programmable; RP2040: up to 16MB off-chip via QSPI

SRAM / ROM

CC1352P7: 144KB ultra-low-leakage SRAM with parity + 8KB cache SRAM + 256KB ROM; RP2040: 264KB SRAM in six banks

Antenna Support

433MHz up to 13dBm, 2.4GHz up to 10dBm

Bootloader

Automatic entry into the CC1352 TI bootloader — no external programmer needed for normal flashing

Debug & Recovery

cJTAG/JTAG on the CC1352 default pin; TagConnect 6-pin SWD connector for external J-Link/ST-Link recovery

Supported OS

Linux (full support), macOS (functional), Windows (compatible)

Firmware License

GNU AGPL v3.0

Hardware License

CERN Open Hardware Licence v1.2

Both hardware generations are flashed and managed through the same Catnip CLI.

Attributev1.x / v2.xv3.x (current)
Bridge MCUMicrochip SAMD21E17 (USB-UART bridge)Raspberry Pi RP2040, dual-core Arm Cortex-M0+ @ 133MHz
Radio MCU memoryCC1352P1: 352KB flash / 80KB SRAMCC1352P7: 704KB flash / 144KB SRAM
Protocol / tooling supportThread, Zigbee, BLE 5.2, 802.15.4g, 6LoWPAN, mioty, Wireless M-Bus, Wi-SUN, TI 15.4-Stack; Wireshark v3.0.x dissectorsThread, Zigbee, Matter, BLE 5.2, Wi-SUN, mioty, Amazon Sidewalk, Wireless M-Bus, TI 15.4-Stack, 6LoWPAN; Wireshark v4.0.x dissectors
Antenna support868/915MHz up to 14dBm, 2.4GHz up to 20dBm433MHz up to 13dBm, 2.4GHz up to 10dBm
What is the CatSniffer?
CatSniffer is a multiprotocol, multiband board in a portable USB-stick form factor for sniffing and communicating with IoT devices across LoRa, Sub-1GHz and 2.4GHz — Zigbee, BLE, Thread and 802.15.4 included. It pairs a TI CC1352P7 radio MCU with a Semtech SX1262 LoRa modem and an RP2040 bridge (V3.x). It is a flash-level device: firmware loads onto the CC1352 via the Catnip CLI before first use.
Flash the firmware for the protocol you want with Catnip — catnip flash ble, zigbee, thread or lora-sniffer — then run catnip sniff to capture; Wireshark opens through the extcap integration if selected. CatSniffer is a wireless penetration testing tool intended solely for authorized security audits where applicable law permits: confirm your legal footing and obtain proper authorization before capturing traffic on any network you do not own.
The CC1352P7 radio covers Thread, Zigbee, Matter, Bluetooth 5.2 Low Energy, IEEE 802.15.4g, 6LoWPAN, mioty, Amazon Sidewalk, Wireless M-Bus and Wi-SUN, plus proprietary Sub-1GHz systems. A dedicated Semtech SX1262 modem adds LoRa and LoRaWAN sniffing and spectrum work, so one board spans Sub-1GHz and 2.4GHz without swapping hardware. Each protocol runs as its own firmware, flashed on demand via Catnip.
Run catnip restore: it uses the onboard RP2040 as a CMSIS-DAP JTAG programmer, through OpenOCD, to reflash a bricked CC1352 — no external hardware required. If that path is unavailable, a SEGGER J-Link on the board’s Tag-Connect TC20X0-CLIP cable and 6-pin SWD connector reflashes it directly. Normal firmware updates need none of this: catnip flash [alias] handles those over the serial bootloader.

You may also like…

Paw-Detector

Paw Detector – Malicious USB cables detector

Security
$39.00
Add to cart
Flipper Zero Add-On: Marauder_Spoof

Flipper Add-On: Marauder_Spoof

Security
$50.00
Read more
Minino

Minino

Security
$65.00
Add to cart
PAW Protector USB data blocker, angled view of the USB-A plug and the clear side of its case with the green board inside

PAW Protector USB Data Blocker

Security
$20.00
Add to cart
Free shipping to the US on orders +$250 USD · to Mexico on orders +$100 USD