filtering with wireshark does not work with nrf52840 dongle

[ziv123]

hello Nordic 

i am working with nrf52832 and nrf52840 as peripherals for a central node (one has nrf ble device and one does not)

i downloaded the image for the nrf52840 sniffer and did the recommended adjustments to run wireshark (i run on ubuntu 24)

now when i just open without any filters i get a lot of packets on wireshark but when i try to filter fo 2 mac address that i want to investigate i don't get anything. now, i know there are working because they are talking via BLE with one another 

any ideas on what i need to do differently or is there some specific way to filter packets by mac address in wireshark 

hope to read you soon

best regards

Ziv

[nordicator_prim3]

Which filter are you using?

bluetooth.addr==<MAC> filter did not work for me either, but btle.advertising_address==<MAC> did.

[ziv123]

hi .. 

i used bluetooth.addr==<MAC>

and i think i even tried another one,

your filter works but i only get the advertising packets, i want to see the packets in connection generation so i can see link layer data like supervision_timeout, maybe channel map etc.

[Kenneth]

Hello,

Check out the user guide:
https://docs.nordicsemi.com/bundle/nrfutil/page/nrfutil-ble-sniffer/guides/common_actions_sniffing_conn_single_periph.html

Btw, my favorite filter is: btle.data_header.llid > 0 && btle.length > 0

Kenneth