Traffic on UDP port 19788

[dakhnod]

I can observe packets like this in wireshark:

Does anyone know what this packet is and how to decode it in wireshark?

Thanks!

[abtink]

UDP port number 19788 is used by Thread MLE.

This guide from openthread.io may help you: Install and Configure Wireshark

[dakhnod]

Thanks! I followed that, the screenshot was taken after that. Should I use the network key from the active dataset?

[abtink]

Yes.

[dakhnod]

Weird, I did that. Are MLE packets encrypted at all?

[jwhui]

Yes, MLE has its own encryption. When configured properly, Wireshark should be able to decrypt them.