ZigBeeNet: Decrypted Zigbee Smart Home Traffic Dataset [15 Devices, 20 Days]

Overview

ZigBeeNet addresses a long-standing gap: the absence of publicly available decrypted Zigbee network traffic captured from a real smart home. Zigbee encrypts frame payloads by default, so most public captures expose only headers. Here the authors recovered the network key, making application-layer commands, sensor readings, and device state updates visible for inspection.

Traffic was captured between 23 September and 14 October 2024 — 20 continuous days — from a live residential deployment.

What's inside

• Format: pcap captures only. The Zenodo release is a single archive, dataset.tar.gz (663.4 MB), expanding to 501 pcap files (~1.64 GB).
• Devices: 15 Zigbee devices in total, spanning 6 functional types — Hub, Power Plug, Smart Light, Smart Bulb, Wall Switch, and Motion Sensor — across 9 distinct device models.
• Network key: supplied with the dataset, so payloads can be decrypted in Wireshark.
• Capture setup: Zigbee sniffer built on a Texas Instruments CC2531 chip with a Wireshark plugin.

Working with the data

The files open in Wireshark. The network key must be added under Edit → Preferences → Protocols → Zigbee → Pre-configured keys before payloads become readable. The authors' GitHub repository provides the key, a merge script for combining captures, and full setup documentation: github.com/iitis/ZigBeeNet.

Recommended tasks

• Zigbee device fingerprinting and traffic pattern analysis
• Protocol- and payload-level anomaly detection in smart homes
• Development and validation of Zigbee traffic generators
• Network performance and behavioural analysis of low-power mesh networks

Limitations

• Zigbee protocol only.
• A single residential environment and layout, over 20 days — the authors note it may not capture heavy-traffic conditions or adversarial scenarios.
• No attack traffic or intrusion labels.

Source and attribution

Dataset: Zenodo record 13957307 (DOI 10.5281/zenodo.13957307), published 20 October 2024, CC BY 4.0. Created at the Institute of Theoretical and Applied Informatics, Polish Academy of Sciences (IITiS PAN).

The authors request that the accompanying paper be cited by anyone using this dataset.