Revision history [back]

I think you will have to post process the tshark output with a shell script or python program.
https://wiki.wireshark.org/SampleCaptures - sample_control4_2012-03-24.pcap ZigBee protocol traffic.

This is from the sample capture and shows that the data can be not consistent so program needs some intelligence:

Command: Write Attributes No Response (0x05)
Attribute Field, Uint8: 1
    Attribute: Unknown (0x0003)
    Data Type: 8-Bit Unsigned Integer (0x20)
    Uint8: 1 (0x01)
Attribute Field, Uint16: 300
    Attribute: Unknown (0x0002)
    Data Type: 16-Bit Unsigned Integer (0x21)
    Uint16: 300 (0x012c)
Attribute Field
    Attribute: Mains Frequency (0x0001)
    Data Type: 16-Bit Unsigned Integer (0x21)
    Measured Mains Frequency: 70 [Hz]
Attribute Field
    Attribute: Unknown (0x0c01)
    Data Type: No Data (0x00)
Attribute Field
    Attribute: Unknown (0x1620)

[Malformed Packet: ZigBee ZCL] [Expert Info (Error/Malformed): Malformed Packet (Exception occurred)] [Malformed Packet (Exception occurred)] [Severity level: Error]