Wireshark : Encrypted packet decrypted incorrectly (bad MIC) and Empty PDU

[MalloryLP]

Hi,

I have difficulties to sniff BLE packets with nRF52840 and wireshark between a remote controller and phone.

I can capture all the pairing process, I see DHKey exchange and I have LTKey from flash of the remote.

Then, if I select SC Private Key, paste LTKey from flash in Wireshark and restart the connection advertising from the remote, I still have Encrypted packet decrypted incorrectly (bad MIC) and Empty PDU for few seconds and then nothing.

What I'm missing ?

Best regards,

MLP.

[Amanda Hsieh]

Hi, 

Select SC Private Key as the input key and type the 32-byte Diffie-Hellman private key of your device in big-endian, hexadecimal format with a leading “0x” into the input field in Wireshark.

If you are using NCS, you can take a look at this course https://academy.nordicsemi.com/courses/bluetooth-low-energy-fundamentals/lessons/lesson-6-bluetooth-le-sniffer/topic/blefund-lesson-6-exercise-3/ 

Regards,
Amanda H.