nrf sniffer does not decode packets on bonded reconnect after encryption

RE: nrf sniffer does not decode packets on bonded reconnect after encryption

brianreinhold — Wed, 25 Sep 2024 10:28:22 GMT

I did restart the capture on every attempt to repair, but I did not restart the capture between the pairing connection and the measurement connection. I will repeat. I only did one capture sequence this morning and it worked.

RE: nrf sniffer does not decode packets on bonded reconnect after encryption

Vidar Berg — Wed, 25 Sep 2024 10:19:26 GMT

The sniffer will automatically store the LTK and reuse it for subsequent connections, provided you do this in the same session. Wireshark will not remember the key if you start a new capture after the key exchange.

[quote userid="83646" url="~/f/nordic-q-a/114985/nrf-sniffer-does-not-decode-packets-on-bonded-reconnect-after-encryption/503717"]I am wondering if the keys are remembered the first time for a given device and not refreshed if one does a re-pairing?[/quote]

The key should be updated if you re-pair, but it is important that the sniffer observes the second pairing. Otherwise, it won't receive the new key.

[quote userid="83646" url="~/f/nordic-q-a/114985/nrf-sniffer-does-not-decode-packets-on-bonded-reconnect-after-encryption/503717"]

Does it make a difference of which 'key' option is displayed? There is

Legacy Passkey
Legacy OOB data
Legacy LTK
etc.

[/quote]

No, this is only relevant if you need to manually input the key yourself.

RE: nrf sniffer does not decode packets on bonded reconnect after encryption

brianreinhold — Wed, 25 Sep 2024 10:02:15 GMT

Does it make a difference of which 'key' option is displayed? There is

Legacy Passkey
Legacy OOB data
Legacy LTK
etc.

If you unpair the device and peer and redo the bonding (so new keys are generated) will this cause a problem on the reconnect? Yesterday the pairing worked but all reconnects failed. This AM I did the same procedure on a fresh restart of the system and both the pairing and reconnect succeeded. I have not tried a repair. I had it on Legacy Passkey with no entry. Yesterday I tried various options of the keys (no entries) and they all gave the same MIC errors on reconnect but succeeded on pairing. I even tried the 'clear' option with the same result.

I am wondering if the keys are remembered the first time for a given device and not refreshed if one does a re-pairing?

RE: nrf sniffer does not decode packets on bonded reconnect after encryption

Vidar Berg — Wed, 25 Sep 2024 09:57:32 GMT

Hello,

Please post the sniffer capture that contains the initial key exchange and the subsequent connection where you see the MIC failures so I can review it.

Best regards,

Vidar