Wireshark : Encrypted packet decrypted incorrectly (bad MIC) and Empty PDU

Hi,

I have difficulties to sniff BLE packets with nRF52840 and wireshark between a remote controller and phone.

I can capture all the pairing process, I see DHKey exchange and I have LTKey from flash of the remote.

Then, if I select SC Private Key, paste LTKey from flash in Wireshark and restart the connection advertising from the remote, I still have Encrypted packet decrypted incorrectly (bad MIC) and Empty PDU for few seconds and then nothing.

What I'm missing ?

Best regards,

MLP.

Parents

0 Amanda Hsieh 23 days ago

Hi,

Select SC Private Key as the input key and type the 32-byte Diffie-Hellman private key of your device in big-endian, hexadecimal format with a leading “0x” into the input field in Wireshark.

If you are using NCS, you can take a look at this course https://academy.nordicsemi.com/courses/bluetooth-low-energy-fundamentals/lessons/lesson-6-bluetooth-le-sniffer/topic/blefund-lesson-6-exercise-3/

Regards,
Amanda H.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 Amanda Hsieh 23 days ago

Hi,

Select SC Private Key as the input key and type the 32-byte Diffie-Hellman private key of your device in big-endian, hexadecimal format with a leading “0x” into the input field in Wireshark.

If you are using NCS, you can take a look at this course https://academy.nordicsemi.com/courses/bluetooth-low-energy-fundamentals/lessons/lesson-6-bluetooth-le-sniffer/topic/blefund-lesson-6-exercise-3/

Regards,
Amanda H.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data