first commit

utils/filter-zigbee.jq

@@ -0,0 +1,24 @@
+#!/usr/bin/env -S jq -c --unbuffered -f
+
+### convert json file:
+#
+# tshark -r zigbee-2025-01-27_08.57.08-hue.pcap  -lq -T ek -x | utils/pcap-extract-zigbee.jq > /tmp/sample.json
+#
+
+### live capture
+#
+# tshark -i lo -lq -T ek -x 'udp port 1337' | utils/pcap-extract-zigbee.jq
+#
+
+.layers
+  | select(.zbee_aps["zbee_aps_zbee_aps_cluster_raw"])
+  | {
+    time: .frame["frame_frame_time_epoch"],
+    index: .frame["frame_frame_number"] | tonumber,
+    src_mac: (.zbee_nwk["zbee_nwk_zbee_sec_src64_raw"] // .wpan["wpan_wpan_addr64_raw"]),
+    src: (.zbee_nwk["zbee_nwk_zbee_nwk_src_raw"] // .wpan["wpan_wpan_addr16_raw"]),
+    dst: (.zbee_nwk["zbee_nwk_zbee_nwk_dst_raw"] // .wpan["wpan_wpan_dst16_raw"]),
+    cluster: .zbee_aps["zbee_aps_zbee_aps_cluster_raw"],
+    cmd: .zbee_zcl["zbee_zcl_zbee_zcl_cmd_id_raw"],
+    data: .zbee_zcl_raw
+  }