Decoding ANCS service discovery using sniffer.

[Jithin A]

Hi,

We are trying to implement Apple Notification Center Service (ANCS) in the custom board, and we came across your implementation.

We try to sniff the discovery procedure using Wireshark and we are getting "Encrypted packet decrypted incorrectly (bad MIC)" error in the Wireshark logs.

We started the sniffer from the beginning itself that is, we are sniffing the board before pairing and even then, we are getting the above error message.

Can anyone please guide us to decrypt these packets as it may help us to replicate the procedure on our end too.

We are new to Wireshark tool and sniffer terms so please help us on how to use the Wireshark and submit the passkey to decrypt these packets.

[Vidar Berg]

Hi,

The service is usually implemented on the iOS device, and the corresponding client implementation on the peripheral. Anyway, to decrypt the packets you need to insert the SC Private Key used for the connection. You can retrieve the key from the debug log if you build your project with CONFIG_BT_LOG_SNIFFER_INFO=y.

Sniffing the pairing procedure of a connection

Best regards,

Vidar

[Jithin A]

Hi Vidar,

Thank you for the quick response.

I see the key in the debug log after enabling the macro you provided.

<inf> bt_keys: SC LTK: 0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

The thing is it is not static key, each time the key changes.

Is there any kconfig param to use static key instead.

Or how to decrypt in wireshark if this is the case. I see in the sniffing link you have provided does not have information on how to sniff pairing info if SC LTK key is used.

Please guide me through this,

[Vidar Berg]

Hi,

The documentation I linked to instructs you to inpu the SC LTK before pairing is iniated:

For connections that use LE Secure Connections with a private key:
Before the devices initiate pairing, select SC Private Key as input key and type the 32-byte Diffie-Hellman private key of your device in big-endian, hexadecimal format with a leading "0x" into the input field in Wireshark.
Initiate pairing between the devices if it does not happen automatically.

[Jithin A]

Correct. 

Can you please guide me where we can get that SC Private key?

I do not see this in the debug log.

[Vidar Berg]

You stated earlier that you could see the key from the debug log.

Jithin A said:

I see the key in the debug log after enabling the macro you provided.

Did something change?