Wireshark not showing nRF Sniffer for 802.15.4

[Schmid]

Hello, I want to use the nRF Sniffer for 802.15.4 to debug my Zigbee Application.

I followed this Guide: https://infocenter.nordicsemi.com/index.jsp?topic=%2Fug_sniffer_802154%2FUG%2Fsniffer_802154%2Fintro_802154.html

When I test the Plugin with:

./nrf802154_sniffer.py --extcap-interfaces

I get the following output:

extcap {version=0.7.2}{help=https://github.com/NordicSemiconductor/nRF-Sniffer-for-802.15.4}{display=nRF Sniffer for 802.15.4}
interface {value=/dev/cu.usbmodemCCE75D56300D1}{display=nRF Sniffer for 802.15.4}
control {number=6}{type=button}{role=logger}{display=Log}{tooltip=Show capture log}

But it won't show up in Wireshark.

M1 Mac, Python 3.11.3, Wireshark Version 3.6.13 (v3.6.13-0-g9aa9aca9c1c1), nrf52840DK

Thanks for any help,

Philipp

[Jørgen Holmefjord]

Hi,

Have you/can you try the following?

• Rebooting the PC after installation? 
• Putting the python script files in both the "Global Extcap path" and "Personal Extcap path" directories?
• Using an older python version?

Best regards,
Jørgen

[Schmid]

Hi, thank you for your answer.

I tried python 3.8, copied the file to Personal as well and rebooted several times, neither did work...

Greetings,

Philipp

[FARLY7]

Currently experiencing the same issue for nRF BLE Sniffer.

• macOS, Apple M1 Pro, Ventura 13.3.1 (a) 
• Python 3.10.9
• Wireshark 4.0.5
• nRF BLE Sniffer v4.1.1
• nRF52 PCA10040 DK

./nrf_sniffer_ble.sh --extcap-interfaces
Running script with: </Users/FARLY7/.pyenv/shims/python3> with PATH: </Users/FARLY7/.pyenv/shims:/opt/homebrew/opt/[email protected]/libexec/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/share/dotnet:~/.dotnet/tools:/Library/Frameworks/Mono.framework/Versions/Current/Commands:/Applications/Wireshark.app/Contents/MacOS:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/Users/FARLY7/go/bin/:/opt/homebrew/opt/ccache/libexec:/usr/local/share/dotnet:/Applications>
extcap {version=4.1.1}{display=nRF Sniffer for Bluetooth LE}{help=https://www.nordicsemi.com/Software-and-Tools/Development-Tools/nRF-Sniffer-for-Bluetooth-LE}
interface {value=/dev/cu.usbmodem0006824846721-None}{display=nRF Sniffer for Bluetooth LE}
control {number=0}{type=selector}{display=Device}{tooltip=Device list}
control {number=1}{type=selector}{display=Key}{tooltip=}
control {number=2}{type=string}{display=Value}{tooltip=6 digit passkey or 16 or 32 bytes encryption key in hexadecimal starting with '0x', big endian format.If the entered key is shorter than 16 or 32 bytes, it will be zero-padded in front'}{validation=\b^(([0-9]{6})|(0x[0-9a-fA-F]{1,64})|([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2}) (public|random))$\b}
control {number=3}{type=string}{display=Adv Hop}{default=37,38,39}{tooltip=Advertising channel hop sequence. Change the order in which the sniffer switches advertising channels. Valid channels are 37, 38 and 39 separated by comma.}{validation=^\s*((37|38|39)\s*,\s*){0,2}(37|38|39){1}\s*$}{required=true}
control {number=7}{type=button}{display=Clear}{tooltop=Clear or remove device from Device list}
control {number=4}{type=button}{role=help}{display=Help}{tooltip=Access user guide (launches browser)}
control {number=5}{type=button}{role=restore}{display=Defaults}{tooltip=Resets the user interface and clears the log file}
control {number=6}{type=button}{role=logger}{display=Log}{tooltip=Log per interface}
value {control=0}{value= }{display=All advertising devices}{default=true}
value {control=0}{value=[00,00,00,00,00,00,0]}{display=Follow IRK}
value {control=1}{value=0}{display=Legacy Passkey}{default=true}
value {control=1}{value=1}{display=Legacy OOB data}
value {control=1}{value=2}{display=Legacy LTK}
value {control=1}{value=3}{display=SC LTK}
value {control=1}{value=4}{display=SC Private Key}
value {control=1}{value=5}{display=IRK}
value {control=1}{value=6}{display=Add LE address}
value {control=1}{value=7}{display=Follow LE address}

.. No "nRF Sniffer for Bluetooth LE" interface shown in Wireshark when refreshing interfaces.

Running the example.py shows the sniffer is working correctly:

FARLY7@MBP extcap % python example.py
Could not find device
Sniffer Device List: [Bluetooth LE device """" ([80, 245, 85, 170, 82, 110, 1]), Bluetooth LE device """" ([51, 156, 70, 158, 56, 209, 1]), Bluetooth LE device """" ([247, 97, 60, 210, 79, 87, 1]), Bluetooth LE device """" ([69, 126, 172, 8, 55, 169, 1]), Bluetooth LE device """" ([234, 146, 227, 69, 150, 144, 1]), Bluetooth LE device """" ([68, 237, 47, 44, 64, 29, 1]), Bluetooth LE device """" ([74, 150, 85, 250, 168, 253, 1]), Bluetooth LE device """" ([28, 26, 192, 114, 225, 176, 0]), Bluetooth LE device """" ([236, 143, 166, 208, 68, 97, 1]), Bluetooth LE device """" ([248, 113, 190, 123, 219, 14, 1]), Bluetooth LE device """" ([8, 158, 195, 45, 176, 168, 1]), Bluetooth LE device "[ADV_DIRECT_IND]" ([84, 3, 132, 195, 36, 184, 0]), Bluetooth LE device """" ([195, 215, 228, 152, 209, 11, 1]), Bluetooth LE device """" ([221, 81, 1, 161, 95, 200, 1])]
inConnection False
currentConnectRequest None
packetsInLastConnection None
nPackets 927

Sniffer Device List: [Bluetooth LE device """" ([80, 245, 85, 170, 82, 110, 1]), Bluetooth LE device """" ([51, 156, 70, 158, 56, 209, 1]), Bluetooth LE device """" ([247, 97, 60, 210, 79, 87, 1]), Bluetooth LE device """" ([69, 126, 172, 8, 55, 169, 1]), Bluetooth LE device """" ([234, 146, 227, 69, 150, 144, 1]), Bluetooth LE device """" ([68, 237, 47, 44, 64, 29, 1]), Bluetooth LE device """" ([74, 150, 85, 250, 168, 253, 1]), Bluetooth LE device """" ([28, 26, 192, 114, 225, 176, 0]), Bluetooth LE device """" ([236, 143, 166, 208, 68, 97, 1]), Bluetooth LE device """" ([248, 113, 190, 123, 219, 14, 1]), Bluetooth LE device """" ([8, 158, 195, 45, 176, 168, 1]), Bluetooth LE device "[ADV_DIRECT_IND]" ([84, 3, 132, 195, 36, 184, 0]), Bluetooth LE device """" ([195, 215, 228, 152, 209, 11, 1]), Bluetooth LE device """" ([221, 81, 1, 161, 95, 200, 1])]
inConnection False
currentConnectRequest None
packetsInLastConnection None
nPackets 954

...

.. Booting into a Windows 11 VM on the same machine with the same devkit with Wireshark v3.6.13/v4.x.x worked fine instead.

[Jørgen Holmefjord]

Can you also try to update the Wireshark version to v4.x.x? From the Wireshark documentation it is mentioned "Apple Silicon hardware is supported natively starting with version 4.0"

[Schmid]

I tried that before and the other Person commenting here has the same Issue with 4.0.5.
Anyway, I switched to BLE Mesh. Thank you for your Help.