Nordic nRF52840 only capturing LE LL in wireshark

[iotjames]

(I am a beginner) Hello, I recently got the Nordic nRF52840 dongle so I can sniff BLE packets from some devices I have. I set up the dongle following the recommended setup guide, it seems to be working but on Wireshark I only see LE LL protocol packets. I bought a very cheap no brand smart watch and I want to see things like the heart rate data when it is collected and after some googling I found out that it would not be under the LE LL section but for whatever reason that's the only packets I get. How can I configure the nRF52840 dongle so that I can see data packets being sent? Any help is appreciated. 

[Einar Thorsrud]

Hi,

nRF Sniffer use Wireshark for packet inspection, and that supports decoding higher layers as well. But for that to be possible the packets need to be decrypted. Are they? If the link use Legacy pairing, it is enough to sniff the pairing procedure (see Sniffing the pairing procedure of a connection). But if LE Secure Connections is used, you need to be able to output the key somehow. For instance, if you pair with a nRF device and dump the key there (if using nRF Connect for Dekstop you can enable CONFIG_BT_LOG_SNIFFER_INFO to get that logged).