No silicon vendor ships an UWB sniffer. We do.

Q: What is a UWB sniffer?

A UWB sniffer is a tool that passively captures, dissects, and decodes IEEE 802.15.4a/z ultra-wideband radio traffic so engineers can see what their ranging and positioning systems are actually transmitting. needCode's Modular UWB Sniffer covers raw PHY capture through protocol-level decode for FiRa, CCC Digital Key, Aliro, and omlox, with Wireshark and CI/CD integration. It is, to our knowledge, the only purpose-built UWB sniffer on the market - no silicon vendor ships one.

Q: Why can't I use a standard sniffer or SDR for UWB?

Because UWB breaks the assumptions generic tools are built on: there is no carrier to lock onto, so pulses must be correlated against the correct preamble code - the wrong code captures zero frames; ranging frames last 150 µs to 2 ms, so one missed synchronisation event loses the round; and in 802.15.4z, AES-128 scrambles the waveform itself, making the pulses the ciphertext. A tool has to be designed for UWB's physics from the start. That's why teams without one fall back to device logs, oscilloscopes, and guesswork.

Q: Which UWB protocols does the sniffer decode?

IEEE 802.15.4a/z PHY and MAC capture is always included; protocol decoders are added as modules - FiRa (DS-TWR, SS-TWR, OWR for AoA, DL-TDoA/UL-TDoA), CCC Digital Key (dynamic STS, multi-anchor O2M TWR, frame hopping), Aliro with dissector updates as the spec evolves, and omlox for industrial RTLS. An IEEE 802.15.4ab decoder covering MMS ranging, Wake-Up Radio, and SENS packets is on the roadmap. Custom decoders for proprietary or pre-standard profiles are built as a professional service.

Q: Can the sniffer decrypt encrypted UWB traffic?

Yes, for systems you hold the keys to: static STS mode for testing, key injection for dynamic STS as used by CCC and Aliro, and STS integrity detection even without the key. With keys provided, you see the full waveform and payload rather than just frame headers. It's a debugging and validation capability for your own products - decryption requires the session keys, by design.

Q: How does the sniffer capture the session setup that happens over BLE or CAN?

CCC, FiRa, and Aliro negotiate session parameters out-of-band before the first UWB packet, so the sniffer observes that exchange too: a BLE companion captures session parameters over the air with a provided LTK, a CAN adapter reads them directly from the vehicle network, parameters can be set manually via YAML/CLI, and bespoke adapters cover proprietary transports. A sniffer that misses the out-of-band exchange is blind from the start - this one is built around it.

Q: Can I find a device's PHY configuration if I don't know it?

Yes - channel, PRF, preamble code, SFD, data rate, STS mode, and preamble length multiply into millions of possible configurations, so the sniffer's smart scan mode sweeps realistic combinations in parallel across multiple probes and locks once traffic is detected. This turns the worst part of UWB debugging - guessing the PHY - into an automated step.

Q: Can the sniffer run in our CI/CD pipeline or HIL bench?

Yes - capture is scriptable via a REST/Python API with automated pass/fail rules and schema-stable JSON output, and the 1U rack-mount variant is designed for automated test benches with external RF connectors. The CCC decoder is HIL-bench-ready, including automatic session-parameter extraction from CAN. On-site integration into your lab or pipeline is available as a professional service.

Q: What form factors is the sniffer available in?

Three, all running the same firmware and protocol modules: a desktop USB unit powered by the host PC for lab debugging, a battery-powered standalone unit with an on-device touchscreen for field troubleshooting without a laptop, and a 1U rack-mount unit with external RF connectors and a REST API for automated test benches. Modules configured once carry across all of them.

Q: Can needCode build a decoder for our proprietary UWB protocol?

Yes - custom protocol decoders are a standing professional service: a Wireshark dissector and sniffer decoder for vendor-specific frames, custom MAC structures, or non-FiRa session management, delivered with full source and test coverage. The work is IP-safe and starts under NDA. It's how pre-standard and proprietary UWB work gets the same tooling as the public standards.

Q: How long does it take to get a sniffer versus building one in-house?

A configured needCode sniffer is quoted within 5 business days of a scoping call and delivered as a tested unit in 4-8 weeks. Building equivalent tooling in-house typically means 18-24 months with a team of 6-8 RF and protocol engineers - hardware bring-up across transceivers, Wireshark dissectors per protocol, and a restart when 802.15.4ab silicon ships. The difference is a year of engineering payroll converted into time-to-first-capture.

The Modular UWB Sniffer is the only purpose-built tool for passive capture, dissection, and decryption of 802.15.4a/z UWB traffic - configurable to your protocol, channel, form factor, and workflow. Decoders for FiRa, CCC Digital Key, Aliro, and omlox, Wireshark and CI/CD integration, and out-of-band session capture over BLE and CAN. Not designed in a vacuum: extracted from 8 years of production UWB engineering inside Qorvo R&D.

Configure your sniffer

See the modular platform

We work with Industry Leaders

UWB is not WiFi. It is not BLE. Standard sniffers don't work here.

Every reason generic tooling fails on UWB is physics or protocol design, not a missing feature. There's no carrier to lock onto - pulses must be correlated against the right preamble code, and the wrong code captures zero frames. A ranging frame lasts 150 µs to 2 ms, so missing one synchronisation event loses the whole round. The session is negotiated before the session: CCC, FiRa, and Aliro exchange parameters out-of-band over BLE or CAN before the first UWB packet, and a sniffer that misses that exchange is blind from the start. Multiply channel, PRF, preamble code, SFD, data rate, STS mode, and preamble length, and there are millions of PHY configurations to guess. And in 802.15.4z, AES-128 scrambles the radio waveform itself - the pulses are the ciphertext.

That's why engineers debugging UWB today work with device logs, oscilloscopes, and guesswork - and why we built this tool while shipping production firmware across nine UWB hardware platforms. It exists because we needed it.

Purpose-built for UWB

Raw 802.15.4a/z PHY capture, preamble-code correlation, STS handling - engineered for the physics generic sniffers can't touch.

Modular to your stack

Start with the base unit; add only the protocol decoders, features, and tooling your product needs.

Extracted, not invented

Built during 8 years of production UWB work inside Qorvo R&D - the tool a shipping team actually reaches for.

One base unit. Modules for everything else.

The sniffer is a platform, not a monolith - the same firmware and protocol modules run across every hardware variant. Four layers, chosen per configuration.

Base Unit

UWB probe hardware with raw 802.15.4a/z PHY capture on channels 5 and 9 (plus legacy 1-6), PHY scanner and sweep mode, generic 802.15.4 MAC dissection, JSON export, and CLI control on Linux, Windows, and macOS. Everything downstream builds on this capture layer - it's always included and always on.

Ultra-Wideband

Protocol Decoders

Add the higher-layer decoders your product speaks: FiRa (DS-TWR, SS-TWR, OWR for AoA, DL-TDoA/UL-TDoA, session lifecycle), CCC Digital Key (dynamic STS, multi-anchor O2M TWR, frame hopping, automatic key extraction from CAN), Aliro (with dissector updates as the spec evolves), and omlox for industrial RTLS. An 802.15.4ab decoder - MMS ranging, Wake-Up Radio, SENS packets - is on the roadmap.

Digital Keys & Access

Indoor Positioning (RTLS)

Feature Add-ons

STS decryption and key injection to see the full waveform and payload rather than just frame headers, a BLE companion for out-of-band session capture, multi-unit time-synchronised capture, and per-frame CIR / advanced PHY data. These are the modules that turn capture into insight - including STS integrity detection even without the key.

BLE

Tooling & Integration

A GUI and Wireshark plug-in with custom dissectors and live extcap streaming - named fields, so filter expressions work natively - plus a scriptable REST/Python API with automated pass/fail rules for CI/CD and HIL benches, multi-node TDoA localization for tracking signal sources across a site, and headless cloud/remote operation for distributed teams. The sniffer plugs into the workflow you already have.

Automated Testing & CI/CD

Debugging UWB with logs, scopes, and guesswork?

Book a discovery call with our CEO

Book a discovery call

Five places a UWB sniffer pays for itself

Select your application - it sets sensible defaults for channel, decoder, and companion capture.

Automotive Digital Key

Passive entry and phone-as-key under CCC Digital Key: dynamic STS, multi-anchor sessions, frame hopping - with a CAN companion that extracts session parameters directly from the vehicle network, ready for the HIL bench.

Automotive & SDV

Digital Keys & Access

Access Control (Aliro)

Keyless access on the CSA's Aliro standard, where the BLE companion observes session setup and correlates it with the UWB ranging traffic - visibility into a spec that's still evolving, with dissector updates included.

Smart Locks & Access Control

Industrial RTLS

Warehouse positioning and asset tracking on omlox: UL-TDoA, DL-TDoA, RToF, and TsToF with multi-anchor session correlation and multi-tag coverage across large sites - plus TDoA localization to verify anchor placement against reality.

Industrial IoT & RTLS

Indoor Positioning (RTLS)

Consumer Electronics

Smart home, mobile payments, and indoor navigation on FiRa - full two-way ranging plus one-way ranging for AoA, DL-TDoA, and UL-TDoA, with session lifecycle decode and distance readable directly in Wireshark.

R&D & Protocol Research

Standards work, interoperability testing, and pre-production debugging: full PHY scanner mode sweeps realistic configuration combinations in parallel across multiple probes and locks once traffic is detected - plus decoders for proprietary and pre-standard protocols, built to order.

Semiconductor Manufacturers

This tool was not designed. It was extracted.

Born inside production UWB work

Built while shipping firmware across 9 hardware platforms during an 8-year partnership inside Qorvo R&D - every module exists because a real debugging problem demanded it, not because a product manager imagined it.

The out-of-band problem, solved

CCC, FiRa, and Aliro negotiate their sessions over BLE or CAN before the first UWB packet - so the sniffer captures that too, with BLE and CAN companions, manual YAML/CLI configuration, and bespoke adapters for proprietary transports. A UWB-only sniffer is blind by design; this one isn't.

Standards-body depth

Active FiRa contributor with 5+ interoperability test events across two continents, UWB Alliance member, and contributing to IEEE 802.15.4ab - which is why the decoders track the spec instead of trailing it.

From your bench into your pipeline

Three form factors on the same firmware - desktop USB for the lab, battery-powered standalone with a touchscreen for the field, and a 1U rack unit with REST API for automated test benches - so the tool follows the product from bring-up to regression.

Four ways to get the sniffer working for you

Hardware and software modules are priced per configuration; professional services are quoted per engagement. Every engagement starts with an NDA and a scoping call.

01 Configure & Deliver

Duration:
Quote within 5 business days · 4-8 weeks to a delivered, tested unit
Best for:
Getting from a technical call to a configured sniffer - application, chipset, protocol target, form factor
Deliverable:
Your configuration built, tested, and delivered with automated tests and documentation

02 Custom Decoder & Integration

Duration:
Per engagement
Best for:
Proprietary or pre-standard UWB profiles, and wiring the sniffer into your lab, CAN bench, or HIL environment on-site
Deliverable:
A Wireshark dissector and sniffer decoder for your protocol - IP-safe, with full source and test coverage - plus on-site setup, calibration, CI hook-up, and knowledge transfer

03 Training Workshop

Duration:
2 days, hands-on
Best for:
Getting an engineering team productive on UWB and the sniffer fast
Deliverable:
Day 1 - UWB protocol fundamentals, PHY parameters, sniffer setup, live captures. Day 2 - advanced dissection, STS decryption, Wireshark filters, CI integration exercises.

04 Maintenance & SLA

Duration:
Annual
Best for:
Teams that need the tool current and supported for the life of the programme
Deliverable:
Firmware updates, new protocol decoder modules as released (FiRa 3.1, 802.15.4ab GA), priority support with guaranteed response times, a dedicated Slack channel, and quarterly roadmap briefings

What's inside

Same firmware and protocol modules across every hardware variant - configure once, deploy where the work is.

Protocols

IEEE 802.15.4a/z (always included)

FiRa

CCC Digital Key

Aliro

omlox

IEEE 802.15.4ab

PHY & capture

Channels 1-9

HRP / EHPRF / LE-UWB

all STS modes (0-3)

PHY scanner / sweep

per-frame CIR

Out-of-band

Manual (YAML / CLI)

custom OoB transports

BLE observer (with provided LTK)

CAN adapter

Decryption

Static STS

key injection for dynamic STS (CCC, Aliro)

STS integrity detection without the key

Form factors

Desktop USB (host-powered, USB-C)

Standalone portable (battery, touchscreen)

Rack-mount 1U (external RF, REST API)

Integration

Wireshark plug-in (Lua/C, live extcap)

REST / Python API

schema-stable JSON · CI/CD & HIL

multi-node TDoA localization

cloud/remote

Case studies

The sniffer's credibility is its origin: it was pulled out of production UWB engineering, not built as a product first.

Qorvo: RF Leadership

Context: Rapid scaling for new chipset bring-up.

Scale: Grew from <10 to 30 FTEs.
Output: Supported bring-up of 9 new hardware platforms (SDKs, Drivers, Stacks).
Retention: Zero-churn core team retained for 5+ years.

Dedicated Development Center for RF Solutions

Bluetooth Mesh Smart Lighting Control System

Smart Lighting: Core R&D Extension

Context: Client needed deep, specialized expertise to pivot from proprietary tech to a new global standard.

Service: Deployed a dedicated squad of embedded engineers to function as the client's core R&D team.
Output: Co-authored official Bluetooth SIG protocols and delivered the world’s first certified BLE Mesh stack.
Value: Enabled the client to secure Series A funding and defined the industry standard for smart buildings.

Creative Werks: Innovation rescue

Context: Hardware obsolescence threatened production shutdown.

Action: Full-stack takeover (PCB redesign + Firmware + Mobile App).
ROI: 1230% ($1.6M value generated).
Speed: Payback period of 2-3 months.

NeedCode-case study - IoT Solution for Boat Lift Modernization - cover2s

PowerPollen: AgTech automation

Context: Lack of internal expertise stalled a critical automation project.

Action: Re-architected system using unified MCU and ISOBUS standards.
ROI: 13.8x ($2.9M value generated).
Impact: Enabled $1.9M increase in harvester value.

Strategic Partnership

needCode is an official business partner of Qorvo, bringing over 8 years of proven expertise and trusted service to the technology sector.

Check our performance

Members of the UWB Alliance

In 2025 we became a member of the UWB Alliance. This strategic step reinforces our commitment to pioneering Ultra-Wideband (UWB) technology.

Proudly Certified for Excellence and Security

needCode is officially certified for:
ISO 9001:2015 – Quality Management
ISO/IEC 27001:2022 – Information Security

ISO certifications reflect our focus on delivering reliable IoT solutions, smart product development, and secure technology services.

Testimonials

“I think the key takeaway from needCode is their ability to adapt and understand the customer's requirements. That took away probably a large portion of what could have been a lot of development time and expense for both companies.”

Bob Folkestad

President at Creative Werks

“One aspect that truly sets needCode apart is its profound expertise in firmware development. Their proficiency in various programming languages, embedded systems and hardware architecture is truly impressive. When faced with difficult problems, their strong problem-solving skills and analytical mindset shine through, allowing them to overcome obstacles with remarkable ease.”

Semeh Sarhan

CEO at Xtrava

“I worked with needCode while leading the NWTN-Berlin team in 2018. A big chunk for our FW development has been outsourced to them and they had proven to iterate very quickly, following specs and deliver on time. It was great working with them. I recommend working with needCode’s team on any Embedded SW development.”

Marco Salvioli Mariani

CTO at NWTN Berlin GmbH

“needCode Team proved to be one of the best engineers I have ever met. The part I like the most about the team is the more difficult an obstacle seems to be, the more motivated they were to find a solution and a way forward.”

Szymon Słupik

CTO at Silvair

“needCode is an outstanding partner. Their quick follow-up, scalability, and extensive professional network set them apart. Their expertise in wireless technologies has been valuable, supporting us from low-level drivers to architecture discussions.”

Tim Allemeersch

Director at Qorvo, Inc.

“needCode did a great job improving the firmware of the Vai Kai connected toys and developing new features, surpassing our expectations multiple times. I would definitely recommend hiring Bartek and needCode for the embedded software projects!”

Matas Petrikas

CEO & Co-founder at Vai Kai UG

Insights

Basics of UWB indoor location systems (indoor RTLS)

Introduction to real-time location systems (RTLS) using ultra-wideband technology RTLS stands for Real Time Location System. As you may guess, such a system aims to provide real-time information about the location of “an object” with respect to “a coordinate system”. This loose definition raises three questions: – Provide information to whom? – What is “an […]

FAQ