unable to sniff packets with wireshark setting higher connection intervals

RE: unable to sniff packets with wireshark setting higher connection intervals

Edvin — Wed, 19 Jun 2024 13:18:29 GMT

Oh, that is not a Nordic nRF52840 Dongle. Ok, now I see.

I see that they claim it will work with the WireShark sniffer, but that will be something that they need to make sure it does. The nRF Sniffer for Bluetooth LE is made to work with the DKs and Dongles produced by Nordic Semiconductor (this dongle), and if it doesn't work with a 3rd party dongle, then you need to contact the 3rd party company to ask why it doesn't do what it promised to do.

That being said, I guess it is a clock issue. Perhaps they use a different Low frequency clock crystal than we use, which doesn't have the same accuracy. Unfortunately, since the sniffer FW is closed source, it is not possible to tweak these parameters, so that it would work on your device.

But you have two devices, right? The 3rd party dongle and something else that the Device Under Test (DUT) is running on. What is the DUT? Another dongle of the same kind? A Nordic dongle/DK?

If it is a nordic device, I guess you could try to swap them around. Run the application on the 3rd party dongle, and run the sniffer on the Nordic device.

Either way, I am sorry, but I don't think there is much else I can do, other than to tell you that the nRF Sniffer for Bluetooth LE works only with Nordic devices, not 3rd party devices.

Best regards,

Edvin

RE: unable to sniff packets with wireshark setting higher connection intervals

antoine98 — Wed, 19 Jun 2024 09:04:21 GMT

Thanks for the explanation Edvin, in the back of my dongle there is a qr code which sends me to this link: https://wiki.makerdiary.com/nrf52840-mdk-usb-dongle/. There is no line pca10059

RE: unable to sniff packets with wireshark setting higher connection intervals

Edvin — Wed, 19 Jun 2024 08:57:54 GMT

Hello,

Yes. For encrypted connections, the sniffer will not be able to follow the connection after a while, because the messages are encrypted, so the sniffer will not be able to pick up the channel update messages, so eventually, it doesn't know what channel to hop to next. In addition, it will not be able to decrypt the packets it actually picks up, so it will just show the raw, undecrypted packets.

Depending on the type of enctyption, it is still possible to make the sniffer decrypt the packets. If the connection is encrypted using "just works" encryption, the sniffer will pick up the keys and use them. If they use a 6-digit passkey you can enter this in the sniffer before you enter it in the BLE devices, and it will be able to decrypt the packets. If you are using bonding, you need to delete bonding information, so that the devices will do the key-exchange again.

LESC however, which uses a Diffie-Hellman key exchange is not possible to sniff, because the keys are never sent over the air, and there is no good way to extract it from the application.

But back to this issue:

What does it say on the Dongle that you are using? On the white sticker on the back, what does it say on the line directly below "pca10059"?

BR,
Edvin

RE: unable to sniff packets with wireshark setting higher connection intervals

antoine98 — Wed, 19 Jun 2024 08:11:55 GMT

Yes I tried with the same dongle as before, unfortunately I have just one dongle. I noticed that i have the same problem with encrypted communications, after some time capturing process end.

RE: unable to sniff packets with wireshark setting higher connection intervals

Edvin — Mon, 17 Jun 2024 13:06:45 GMT

Hmm. I am still not able to reproduce it in v4.1.1 of the nRF Sniffer for Bluetooth LE.

[quote user="antoine98"]extcap files on another computer and the result is the same[/quote]

Is this with the same nRF52840 dongle?

Can you try with another Dongle, or another DK for the sniffer? If you have an extra nRF device?

BR,
Edvin

RE: unable to sniff packets with wireshark setting higher connection intervals

antoine98 — Mon, 17 Jun 2024 08:46:01 GMT

I installed extcap file and relative profile. I have now tryed to install from 0 wireshark, python and relative extcap files on another computer and the result is the same. When i use a connection interval of 2000ms capuring process stops after connection parameter update

RE: unable to sniff packets with wireshark setting higher connection intervals

Edvin — Fri, 14 Jun 2024 20:41:36 GMT

That is very strange. Did you only use the .hex file, or did you install the entire sniffer 4.1.0 in wireshark (with the extcap files and all those things)?

Have you tried using a different device (DK instead of dongle)? Or have you tried a different computer?

BR,

Edvin

RE: unable to sniff packets with wireshark setting higher connection intervals

antoine98 — Thu, 13 Jun 2024 08:57:43 GMT

I have now tryed with version 4.1.0, but nothing changed. The capturing process stops after connection parameters update as before.

RE: unable to sniff packets with wireshark setting higher connection intervals

antoine98 — Thu, 13 Jun 2024 08:37:45 GMT

I used version 4.1.1, i will now try with version 4.1.0 and I'll let you know

RE: unable to sniff packets with wireshark setting higher connection intervals

Edvin — Wed, 12 Jun 2024 20:50:37 GMT

Hello,

I didn't see the same. I set up the sniffer on the dongle at work today, but I am not able to change the sniffer FW from my home office. I will give it another go with the latest sniffer FW flashed to the dongle tomorrow.

In the meantime, what version of nRF Sniffer for Bluetooth LE did you use? If you have not already, can you try the v4.1.0, which I am currently using, and see if that changes anything for you?

Best regards,

Edvin

RE: unable to sniff packets with wireshark setting higher connection intervals

antoine98 — Tue, 11 Jun 2024 14:23:53 GMT

devzone.nordicsemi.com/.../sniffer_5F00_uart.pcapng

This is a track done with the uart example setting:

#define MAX_CONN_INTERVAL MSEC_TO_UNITS(2000, UNIT_1_25_MS)

#define MIN_CONN_INTERVAL MSEC_TO_UNITS(2000, UNIT_1_25_MS)

#define CONN_SUP_TIMEOUT MSEC_TO_UNITS(8010, UNIT_10_MS)

the problem is the same

RE: unable to sniff packets with wireshark setting higher connection intervals

antoine98 — Tue, 11 Jun 2024 13:09:09 GMT

yes, the peripheral is firstly reset.

In segger I can see that the communication with packet exchange has been correctly performed, but i cannot see the packet exchange in wireshark since the sniffing process stops immediatly after the parameter exchange.

It happens each time I set a connection interval which at least 2000ms.

The devices are not bonded nor paired.

The two boards are nrf52dk, I didn't tryed with other examples setting a CI of 2000ms but I will do

RE: unable to sniff packets with wireshark setting higher connection intervals

Edvin — Tue, 11 Jun 2024 12:59:16 GMT

Is this what happened on the first time they disconnected in the trace as well? (around packet nr. 939?) I guess that was just a reset of the peripheral?

At the end of the trace, are the devices still connected after the sniffer stops receiving packets? Or do you see something in the application logs indicating that the devices are no longer connected?

And does it happen in the exact same place every time?

From the sniffer trace, it doesn't look like this is the case, but your devices aren't bonded/paired? Right?

And no, as far as I know, It shouldn't be any problems for the sniffer to keep track of a connection with connection interval = 2000ms.

Is there some way for me to reproduce what you are seeing? Are both your peripheral and central an nRF? Are they running on DKs?

Best regards,

Edvin

RE: unable to sniff packets with wireshark setting higher connection intervals

antoine98 — Tue, 11 Jun 2024 12:36:36 GMT

Hi Edvin,

I'm using a nRF52840 USB dongle as a sniffer.

The track is this:

devzone.nordicsemi.com/.../track_5F00_sniffer.pcapng

As you can see there after connection parameter exchange the sniffing process ends

RE: unable to sniff packets with wireshark setting higher connection intervals

Edvin — Tue, 11 Jun 2024 12:25:12 GMT

Hello,

What device are you using as the sniffer? and is it possible to upload the sniffer trace (.pcapng file) that you recorded that wasn't able to keep track of the connection?

Best regards,

Edvin