Coded PHY on BLE sniffer not working?

RE: Coded PHY on BLE sniffer not working?

matt.nickels — Fri, 17 Jan 2025 21:49:44 GMT

Any update on this issue? Latest ble-sniffer in nrfutil from what I am garnering doesn't work with Wireshark, and can't capture LE Coded PHY packets in the nrfutil command line. My primary purpose for using NRF device is the LE Coded PHY support, so I am pretty hamstrung by these bugs.

RE: Coded PHY on BLE sniffer not working?

Emil Lenngren — Tue, 24 Dec 2024 17:37:40 GMT

After reading https://www.adam-thomas.co.uk/blog/nrfutil-bluetooth-sniffer-with-tshark/ I now understand that there are two variants of the host part of the nrf ble sniffer, one "old" in Python and one "new" in Rust.

The Python one works for me with Wireshark:

$ nrf_sniffer_for_bluetooth_le_4.1.1/extcap/nrf_sniffer_ble.sh --extcap-interfaces --extcap-version=4.2
extcap {version=4.1.1}{display=nRF Sniffer for Bluetooth LE}{help=https://www.nordicsemi.com/Software-and-Tools/Development-Tools/nRF-Sniffer-for-Bluetooth-LE}
interface {value=/dev/ttyACM0-4.2}{display=nRF Sniffer for Bluetooth LE}
control {number=0}{type=selector}{display=Device}{tooltip=Device list}
control {number=1}{type=selector}{display=Key}{tooltip=}
control {number=2}{type=string}{display=Value}{tooltip=6 digit passkey or 16 or 32 bytes encryption key in hexadecimal starting with '0x', big endian format.If the entered key is shorter than 16 or 32 bytes, it will be zero-padded in front'}{validation=\b^(([0-9]{6})|(0x[0-9a-fA-F]{1,64})|([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2}) (public|random))$\b}
control {number=3}{type=string}{display=Adv Hop}{default=37,38,39}{tooltip=Advertising channel hop sequence. Change the order in which the sniffer switches advertising channels. Valid channels are 37, 38 and 39 separated by comma.}{validation=^\s*((37|38|39)\s*,\s*){0,2}(37|38|39){1}\s*$}{required=true}
control {number=7}{type=button}{display=Clear}{tooltop=Clear or remove device from Device list}
control {number=4}{type=button}{role=help}{display=Help}{tooltip=Access user guide (launches browser)}
control {number=5}{type=button}{role=restore}{display=Defaults}{tooltip=Resets the user interface and clears the log file}
control {number=6}{type=button}{role=logger}{display=Log}{tooltip=Log per interface}
value {control=0}{value= }{display=All advertising devices}{default=true}
value {control=0}{value=[00,00,00,00,00,00,0]}{display=Follow IRK}
value {control=1}{value=0}{display=Legacy Passkey}{default=true}
value {control=1}{value=1}{display=Legacy OOB data}
value {control=1}{value=2}{display=Legacy LTK}
value {control=1}{value=3}{display=SC LTK}
value {control=1}{value=4}{display=SC Private Key}
value {control=1}{value=5}{display=IRK}
value {control=1}{value=6}{display=Add LE address}
value {control=1}{value=7}{display=Follow LE address}

but the new one in Rust doesn't work with Wireshark:

$ ~/.local/lib/wireshark/extcap/nrfutil-ble-sniffer-shim --extcap-interfaces --extcap-version=4.2
extcap {version=0.14.1}{display=nRF Sniffer for Bluetooth LE}{help=https://www.nordicsemi.com/Software-and-Tools/Development-Tools/nRF-Sniffer-for-Bluetooth-LE}
control {number=0}{type=selector}{display=Device}{tooltip=Device list}
control {number=1}{type=selector}{display=Key}{tooltip=}
control {number=2}{type=string}{display=Value}{tooltip=6 digit passkey or 16 or 32 bytes encryption key in hexadecimal starting with '0x', big endian format. If the entered key is shorter than 16 or 32 bytes, it will be zero-padded in front}{validation=\b^(([0-9]{2,6})|(0x[0-9a-fA-F]{1,64})|([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2}) (public|random))$\b}
control {number=3}{type=string}{display=Adv Hop}{default=37,38,39}{tooltip=Advertising channel hop sequence. Change the order in which the sniffer switches advertising channels. Valid channels are 37, 38 and 39 separated by comma.}{validation=^\s*((37|38|39)\s*,\s*){0,2}(37|38|39){1}\s*$}{required=true}
control {number=7}{type=button}{display=Clear}{tooltip=Clear or remove device from Device list}
control {number=4}{type=button}{role=help}{display=Help}{tooltip=Access user guide (launches browser)}
control {number=5}{type=button}{role=restore}{display=Defaults}{tooltip=Resets the user interface and clears the log file}
control {number=6}{type=button}{role=logger}{display=Log}{tooltip=Log per interface}
value {control=0}{value= }{display=All advertising devices}{default=true}
value {control=0}{value=00:00:00:00:00:00 public}{display=Follow IRK}
value {control=1}{value=0}{display=Legacy Passkey}{default=true}
value {control=1}{value=1}{display=Legacy OOB data}
value {control=1}{value=2}{display=Legacy LTK}
value {control=1}{value=3}{display=SC LTK}
value {control=1}{value=4}{display=SC Private Key}
value {control=1}{value=5}{display=IRK}
value {control=1}{value=6}{display=Add LE address}
value {control=1}{value=7}{display=Follow LE address}
value {control=1}{value=8}{display=Sniffer Drift}

As you can see, no "interface" is listed. Running Ubuntu 24.04. As mentioned earlier, running it from the command line using "nrfutil ble-sniffer sniff" works though.

RE: Coded PHY on BLE sniffer not working?

matt.nickels — Tue, 17 Dec 2024 14:49:45 GMT

Case ID: 337828

RE: Coded PHY on BLE sniffer not working?

Hung Bui — Tue, 17 Dec 2024 11:57:11 GMT

Hi Matt,

Please create a new ticket for your issue.

RE: Coded PHY on BLE sniffer not working?

matt.nickels — Mon, 16 Dec 2024 22:18:20 GMT

System info. Ubuntu Server 22.04

Sniffer Firmware is 4.1.1.hex

$ nrfutil --version
nrfutil 7.13.0 (8289424 2024-07-01)
commit-hash: 82894242d19ff24a1541712312b3ea3af0ca8f85
commit-date: 2024-07-01
host: x86_64-unknown-linux-gnu
build-timestamp: 2024-07-01T07:32:31.582129656Z
classification: nrf-external

$ nrfutil ble-sniffer --version
nrfutil-ble-sniffer 0.14.1 (0cf4b58 2024-10-28)
commit-hash: 0cf4b584c0645a208dc6e7f562596318d6414f5f
commit-date: 2024-10-28
host: x86_64-unknown-linux-gnu
build-timestamp: 2024-10-28T14:50:49.379067757Z
classification: nrf-external

$ nrfutil device list

D4DF85770DA5CEA9
product nRF Sniffer for Bluetooth LE
ports /dev/ttyACM0
traits nordicUsb, serialPorts, usb

$ uname -r
5.15.0-125-generic

RE: Coded PHY on BLE sniffer not working?

matt.nickels — Mon, 16 Dec 2024 22:10:00 GMT

I would like to second this issue. I am unable to get any LE Coded packets using this in command line. I need to run this on Ubuntu Server so I don't have the Wireshark GUI as an option, need command line to work. I have similarly tried various combinations of the --scan-follow flags, --only-advertising, and --coded flag without any success.

RE: Coded PHY on BLE sniffer not working?

Hung Bui — Wed, 11 Dec 2024 13:42:09 GMT

Thanks Emil, I will report to the team.

RE: Coded PHY on BLE sniffer not working?

Emil Lenngren — Wed, 11 Dec 2024 10:03:02 GMT

Correct. "nrfutil install ble-sniffer"

RE: Coded PHY on BLE sniffer not working?

Hung Bui — Wed, 11 Dec 2024 10:01:13 GMT

Hi Emil,
Good to know you find a way to fix it. I think the main problem is the incompatibility with Python v3.12 and later.

How did you install nRF Sniffer ? Have you tried to install nrf Sniffer from nrfutil ?

RE: Coded PHY on BLE sniffer not working?

Emil Lenngren — Tue, 10 Dec 2024 19:28:23 GMT

Thanks, prepending each problematic line with "r" fixed that error. Maybe consider release an update which fixes that?

RE: Coded PHY on BLE sniffer not working?

Hung Bui — Tue, 10 Dec 2024 19:24:49 GMT

Hi Emil,
Could you check this ticket ? invalid escape sequence \s

RE: Coded PHY on BLE sniffer not working?

Emil Lenngren — Tue, 10 Dec 2024 19:11:02 GMT

Sniffer version is 4.1.1. "nrfutil ble-sniffer" version is 0.14.1.

Python version is 3.12.3.

Wireshark version is whatever comes with Ubunut 24.04, i.e. 4.2.2.

I managed to get the Wireshark plugin working by running "/usr/bin/python3 -m pip install -r requirements.txt --break-system-packages" in the extcap folder. I don't know why the "break system packages" was necessary. The system package python3-pyserial does not exist.

The coded phy options on the command line seem broken but it works with the settings in the Wireshark GUI. However, whenever I press the stop button I get a popup with this error:

Error from extcap pipe: /home/emil/.local/lib/wireshark/extcap/nrf_sniffer_ble.py:187: SyntaxWarning: invalid escape sequence '\s'
  "{validation=^\s*((37|38|39)\s*,\s*){0,2}(37|38|39){1}\s*$}{required=true}" % CTRL_ARG_ADVHOP)
/home/emil/.local/lib/wireshark/extcap/nrf_sniffer_ble.py:716: SyntaxWarning: invalid escape sequence '\s'
  m = re.search("^\s*rssi\s*(>=?)\s*(-?[0-9]+)\s*$", capture_filter, re.IGNORECASE)

RE: Coded PHY on BLE sniffer not working?

Hung Bui — Mon, 09 Dec 2024 20:24:33 GMT

Hi Emil,

Could you let me know which nRF Sniffer version you are using ?
Also please let me know the wireshark version.

I'm not so familiar with the installation on Linux but could you try to do step 3 at section 2.2 in this document ? https://docs.nordicsemi.com/bundle/nrfutil_ble_sniffer_pdf/resource/nRF_Sniffer_BLE_UG_v4.0.0.pdf

It's the best if you can run in it with Wireshark.
I assume you can capture BLE advertising packet at 1Mbps and only having trouble with CODED PHY ?