ZigBee networks are integrating rapidly into critical infrastructures such as the smart grid and public health centers. Numerous ZigBee-based smart meters have been installed in metropolitan areas and hospitals commonly employ ZigBee technology for patient and equipment monitoring. The associated ZigBee networks transport sensitive information and must be secured against exfiltration and denial-of-service attacks. Indeed, novel tools that exploit and disrupt ZigBee networks are already under development. Security monitors that can uniquely identify nodes by their radio frequency characteristics can be a valuable countermeasure if implemented in a practical manner. This paper investigates rekeying in response to suspected malicious devices that may be internal or external to a ZigBee network. It extends prior discussions of practical physical layer monitor implementation, and introduces a novel backward-compatible ZigBee message obfuscation technique based on preamble modifications. Experimental results demonstrate that common wireless ZigBee sniffers can be thwarted with 100% effectiveness without reducing packet reception to specific transceiver models.