nrf sniffer not able to capture packages after connection

[Jwang]

Hi,

I am using a NRF52840Dongle sniffering ble communication. But no packages can be captured after connection (sometimes the connection package cannot be captured either). 

I have followed all the steps in the user guide: nRF Sniffer for Bluetooth LE v4.1.x, and tried both sniffer_nrf52840dongle_nrf52840_4.1.0.hex and sniffer_nrf52840dongle_nrf52840_4.1.1.hex. Neither works. I have also a nrf52840DK, which experiences the same issue.

Here are some information on my test setup:

OS: I tried both Windows and Linux

JLink: v.7.80

python 3.11.1

Wireshark: 4.0.6

nrf connect programmer 3.0.9

Steps:

1. sniffer all advertisement

2. Select the device I want to sniffer (the advertising device)

3. Connect to the device that is advertising (not encrypted between the devices)

One difference I noticed in my Wireshark view is that there is not a column of destination. What can be wrong? Thank you!

[ovrebekk]

Hi Jenny

I am sorry for the slow response on my end. 

Jwang said:

it only works when selecting the device address of the gatt server.

The gatt server is the bl653 device I assume? 

It makes sense that the sniffer would only work if you select the device address of the peripheral device. Essentially the sniffer doesn't care which central device establishes the connection, it looks for connections targeting a particular peripheral. 

Part of the reason for this is that many phones will use a private BLE address, which will change over time, rather than a random static address. 

Best regards
Torbjørn

[Jwang]

Thank you Torbjorn for the detailed explanation! I wonder if this can be added to the user guide that when sniffing the communication, always choose the peripheral device?

[ovrebekk]

Hi Jenny

Normally the central device won't show up in the list at all, since it is not advertising, so in most use cases this shouldn't be a problem. 

I can discuss it with one of my colleagues when he's back from vacation, he has a lot more experience with the sniffer than me and would know if this is a common concern. 

Best regards
Torbjørn