Odd random L2CAP Fragment packets observed in Wireshark trace

RE: Odd random L2CAP Fragment packets observed in Wireshark trace

Susheel Nuguru — Tue, 22 Jul 2025 08:07:52 GMT

You can explicitly verify those random “L2CAP Fragment” lines by enabling SDU reassembly in Wireshark’s Bluetooth L2CAP preferences. After you do, Wireshark will stitch the fragments back together and show the full L2CAP signaling PDU. I am no expert in this so probably the Wireshare Wiki or this devzone thread could help you.

RE: Odd random L2CAP Fragment packets observed in Wireshark trace

Blue Five — Wed, 16 Jul 2025 13:53:47 GMT

Thank you for the response. It was along the lines of what I was thinking.

Is there a way to specifically verify that's what these types of packets are?

RE: Odd random L2CAP Fragment packets observed in Wireshark trace

Susheel Nuguru — Wed, 16 Jul 2025 06:15:42 GMT

During normal operation the peripheral’s BLE controller will occasionally send L2CAP signaling messages, most commonly connection-parameter update requests that get split across multiple link-layer packets. Your over-the-air sniffer sees these, but Xcode’s PacketLogger (which logs only HCI-level host traffic on the central) does not. They are perfectly normal behavior and harmless transmissions. If you would like to suppress them in Wireshark, simply filter out “L2CAP Fragment” PDUs or the specific L2CAP signaling codes you don’t need to see.