Kisbee

Kisbee is a project to create a small, battery powered, open source hardware device for capturing 802.15.4 (aka Zigbee).

Kisbee gets approximately 20 hours runtime on a 1000MAh battery, in receive mode.

Project Status

• XXX XX, 2013 - No, I'm not dead, and the project isn't either - just oft postponed. Sorry for dropping the ball on things as much I have, too many irons in too many fires.

Purchasing

The ball got dropped on getting v3 done; I still plan to get back to finishing a factory assemble-able version, stay tuned! Sign up for announcements on the Google Groups announcements list here or follow the Kismet twitter feed.

Using Kisbee

Powering up: Kisbee will display 4 LEDs during boot-up:

1. CPU initialized - CPU has booted, crystal is running, user code is starting to execute
2. USB subsystem complete - USB subsystem initialized, or no USB detected (detatched/bluetooth operation)
3. 802.15.4 radio OK - The MRF radio chip is working (at least, well enough to return known values)
4. Bluetooth OK - The Bluetooth module accepted the setup commands

Using with Android:

1. Install the Kisbee app from the Google Play marketplace.
2. Enable Bluetooth in your devices Settings panel
3. Scan for devices from the Bluetooth settings panel
4. Pair with the device. The Bluetooth pairing code is 1234
5. Launch the Kisbee app
6. Select 'Connect to Device' and select the Kisbee device

Under Android, packets are logged to a CSV file (if enabled in Preferences) in /mnt/sdcard/kisbee (or whatever the primary external storage directory is for your device). Packet locations are displayed on the map. Channel control is reached via the Preferences panel.

Using with a PC:

1. Get the Kisbee directory from Git: git clone https://www.kismetwireless.net/kisbee.git
2. Testing scripts are in the util/ directory. serialdev-debug.py will activate the device and print packets.
3. More to come soon, including updated Kismet plugin! The PC host code is under active development and will show up in the util/ directory in git and in the Kismet repository as a Kismet plugin. Swing by #kismet on irc.freenode.net for updates.

Hardware

Kisbee V2 is designed around the Microchip MRF24J40MC-I radio module, which is a self-contained SMT module which houses a radio, crystal, LNA, and PA, connected via SPI to the microcontroller.

Switching to the self-contained module feels like cheating but offers a lot of advantages. Hopefully using this module gives equivalent performance to previous design goals, while collapsing the PCB design to 2 layers (significantly easier cheaper to fab) and drastically simplifying the assembly (making hand-soldering pretty simple for anyone with SMT experience).

Kisbee V2R0 is the first production run hardware.

No special hardware is needed for flashing. By bridging the appropriate pins (exposed in the design as half-pitch headers) the LPC processor can be placed into a USB firmware update mode, where it emulates a USB mass storage device. Uploading new firmware to the Kisbee is trivial.

The battery charging circuit is unpopulated, after consideration of the dangers around li/po battery handling. The parts required are in the BOM and may be safely populated, if and only if the li/po cell used has an automatic low voltage cut-off. There is no low-voltage detection in the Kisbee circuit.

Battery concerns are only applicable to directly attached batteries. These are not a problem using an external USB charger, which is the recommended method.

Firmware

Kisbee firmware is based on the microBuilder.eu library, which makes things exceptionally easy.

The firmware currently supports:

• The Linux-Serialdev 802.15.4 serial protocol; This is the protocol supported by Kismet, as well as the Linux serialdev kernel module.
• USB serial via CDC-ACM
• Bluetooth RFCOMM via UART
• Monitor/Promisc mode
• Fixed channel monitoring
• Firmware-controlled channel hopping using an extension of the Serialdev protocol, minimizing host-kisbee communications
• Signal level reporting
• Intelligent firmware channel hopping with automatic delays on channels showing traffic
• Fox-hunt mode periodic transmit

Future firmware plans include:

• Transmit mode for packet injection/bidirectional communication using serialdev protocol
• Full 802.15.4 stack for TX interaction beyond serialdev/single packet injection

Software

Kisbee will be fully supported by Kismet under the Phy-Neutral architecture, which unifies sniffing multiple wireless phy layers into a single report and UI. This support is ongoing and will be in the Kismet development code and all future releases.

The Kisbee Android app communicates over bluetooth rfcomm. While still requiring polish, nearly all functionality is complete and working.

Current Android support includes:

• CSV logging to sdcard, with GPS and packet data
• Channel control (locking, selective hopping, etc)
• Automatic connection & reconnection to Kisbee device
• Realtime map display

Future Android plans include:

• XML logging
• Database logging
• General polish and stability updates

The android application is available in the Git repository, and is also available in the Google Play market here

Download

Currently all Kisbee code is stored in the Kisbee Git repository, available via:

git clone https://www.kismetwireless.net/kisbee.git

PCB design files can be found in the Kisbee Git hardware directory

Android code can be also be found in the Kisbee Git repository

Screenshots / Hardware

Kisbee V2R0, external antenna, size comparison with battery.	Kisbee V2R0 design
Android app map display	Android app device selector
Android app prefs	Android app channel picker