Hi powaLess,
I have the same thing here do sniff nrf24 since days. But actually, I was not able to filter some sending MAC address that might be originated in on of my two MI-300 inverters. So in the meantime I'm afraid, Hoymiles implemented the NRf24 chips into a listening-mode by default, that needs to be actively connected by a DTU to start sending out data. Stil there's hope that the Micro-Inverters send beacons by them selves, but hops gets smalled every day.
So, In case there's anything you were able to find out, please share it here 🙂
BR, P.