nRF Mesh Sniffer Crashing when trying to decrypt traffic

[Arne M.]

Hello,

I have set up the light and light_switch BT Mesh examples on my nRF52840DKs. I have used the nRF Mesh app to provision them successfully and I can see that they work.

But when I now use the nRF Mesh Sniffer app version 1.0.0 and add the network and application Keys from my provisioning, the app crashes during sniffing, as soon as I press the button on the light_switch sample. It seems like the app fails during the decryption.
Because when I don't add an application key to the sniffer app, everything works fine.

I attached the apps Logcat logs, but the stacktrace looks obfuscated, so I have no idea what could be the problem. The link to the stacktrace

But I assume it has to do with the packet sizes being sent over mesh. Because when I use a custom vendor model, which sends 6 bytes of payload in a packet, it doesn't crash. (Using the same network / application keys)

I also attached the export of the scan. 
The Network Key is 0x7E756F2C17FC8F44EB941ACF8F30BBD2 with index 0x0 and the application key is 0xEAA7B4D9A05FFFFBC93E9A633DE22388. (They are development keys, so I am not leaking production keys )

Fullscreen 3823.Scan session.json Download

{"scanSessionDb":{"scanSessionID":29,"name":"Scan session","timestamp":1756362707804,"hasScanned":true},"meshMessages":[{"messageID":333,"sessionID":29,"type":{"type":"no.nordicsemi.android.mesh.sniffer.storage.traffic.MessageType.Mesh.ACC"},"timestamp":844,"realTimeStamp":1756362708702,"rawData":[23,42,102,116,6,-43,76,106,28,10,69,-30,40,-8,-3,-21,-64,20,88,-77,23,90,60,-12],"rssi":-56,"deviceName":"Unknown","deviceAddress":"19:38:FB:7E:57:AF","ivIndex":[0,0,0,0],"keyValue":[126,117,111,44,23,-4,-113,68,-21,-108,26,-49,-113,48,-69,-46],"ivi":false,"nid":102,"ctl":false,"ttl":7,"seq":[0,0,32],"src":[0,22],"dst":[0,18],"transportPDU":[105,-53,118,-109,59,-14,72,-114,-30],"NetMIC":[23,90,60,-12],"seg":false,"akf":true,"aid":41,"szmic":false,"transportMIC":[-14,72,-114,-30]},{"messageID":334,"sessionID":29,"type":{"type":"no.nordicsemi.android.mesh.sniffer.storage.traffic.MessageType.Mesh.ACC"},"timestamp":890,"realTimeStamp":1756362708748,"rawData":[22,42,102,13,-113,-14,-51,-19,91,78,113,-109,-109,-101,-87,-14,62,93,105,-79,-2,-17,47],"rssi":-57,"deviceName":"Unknown","deviceAddress":"2E:1D:F8:04:85:C4","perSessionID":1,"ivIndex":[0,0,0,0],"keyValue":[126,117,111,44,23,-4,-113,68,-21,-108,26,-49,-113,48,-69,-46],"ivi":false,"nid":102,"ctl":false,"ttl":7,"seq":[0,0,29],"src":[0,18],"dst":[0,22],"transportPDU":[105,-90,37,5,113,-114,-85,89],"NetMIC":[-79,-2,-17,47],"seg":false,"akf":true,"aid":41,"szmic":false,"transportMIC":[113,-114,-85,89]},{"messageID":335,"sessionID":29,"type":{"type":"no.nordicsemi.android.mesh.sniffer.storage.traffic.MessageType.Mesh.ACC"},"timestamp":894,"realTimeStamp":1756362708752,"rawData":[23,42,102,116,6,-43,76,106,28,10,69,-30,40,-8,-3,-21,-64,20,88,-77,23,90,60,-12],"rssi":-56,"deviceName":"Unknown","deviceAddress":"19:38:FB:7E:57:AF","perSessionID":2,"ivIndex":[0,0,0,0],"keyValue":[126,117,111,44,23,-4,-113,68,-21,-108,26,-49,-113,48,-69,-46],"ivi":false,"nid":102,"ctl":false,"ttl":7,"seq":[0,0,32],"src":[0,22],"dst":[0,18],"transportPDU":[105,-53,118,-109,59,-14,72,-114,-30],"NetMIC":[23,90,60,-12],"seg":false,"akf":true,"aid":41,"szmic":false,"transportMIC":[-14,72,-114,-30]},{"messageID":336,"sessionID":29,"type":{"type":"no.nordicsemi.android.mesh.sniffer.storage.traffic.MessageType.Mesh.ACC"},"timestamp":913,"realTimeStamp":1756362708771,"rawData":[22,42,102,13,-113,-14,-51,-19,91,78,113,-109,-109,-101,-87,-14,62,93,105,-79,-2,-17,47],"rssi":-57,"deviceName":"Unknown","deviceAddress":"2E:1D:F8:04:85:C4","perSessionID":3,"ivIndex":[0,0,0,0],"keyValue":[126,117,111,44,23,-4,-113,68,-21,-108,26,-49,-113,48,-69,-46],"ivi":false,"nid":102,"ctl":false,"ttl":7,"seq":[0,0,29],"src":[0,18],"dst":[0,22],"transportPDU":[105,-90,37,5,113,-114,-85,89],"NetMIC":[-79,-2,-17,47],"seg":false,"akf":true,"aid":41,"szmic":false,"transportMIC":[113,-114,-85,89]},{"messageID":337,"sessionID":29,"type":{"type":"no.nordicsemi.android.mesh.sniffer.storage.traffic.MessageType.Mesh.ACC"},"timestamp":926,"realTimeStamp":1756362708784,"rawData":[22,42,102,13,-113,-14,-51,-19,91,78,113,-109,-109,-101,-87,-14,62,93,105,-79,-2,-17,47],"rssi":-60,"deviceName":"Unknown","deviceAddress":"2E:1D:F8:04:85:C4","perSessionID":4,"ivIndex":[0,0,0,0],"keyValue":[126,117,111,44,23,-4,-113,68,-21,-108,26,-49,-113,48,-69,-46],"ivi":false,"nid":102,"ctl":false,"ttl":7,"seq":[0,0,29],"src":[0,18],"dst":[0,22],"transportPDU":[105,-90,37,5,113,-114,-85,89],"NetMIC":[-79,-2,-17,47],"seg":false,"akf":true,"aid":41,"szmic":false,"transportMIC":[113,-114,-85,89]},{"messageID":338,"sessionID":29,"type":{"type":"no.nordicsemi.android.mesh.sniffer.storage.traffic.MessageType.Mesh.ACC"},"timestamp":1001,"realTimeStamp":1756362708859,"rawData":[23,42,102,-117,59,53,-20,7,-90,-102,-58,85,-2,1,37,-33,-63,-108,22,28,-52,-5,90,90],"rssi":-55,"deviceName":"Unknown","deviceAddress":"1E:CC:86:95:BE:6F","perSessionID":5,"ivIndex":[0,0,0,0],"keyValue":[126,117,111,44,23,-4,-113,68,-21,-108,26,-49,-113,48,-69,-46],"ivi":false,"nid":102,"ctl":false,"ttl":7,"seq":[0,0,33],"src":[0,22],"dst":[0,18],"transportPDU":[105,-43,-108,-113,88,54,108,105,102],"NetMIC":[-52,-5,90,90],"seg":false,"akf":true,"aid":41,"szmic":false,"transportMIC":[54,108,105,102]},{"messageID":339,"sessionID":29,"type":{"type":"no.nordicsemi.android.mesh.sniffer.storage.traffic.MessageType.Mesh.ACC"},"timestamp":1029,"realTimeStamp":1756362708887,"rawData":[23,42,102,-117,59,53,-20,7,-90,-102,-58,85,-2,1,37,-33,-63,-108,22,28,-52,-5,90,90],"rssi":-56,"deviceName":"Unknown","deviceAddress":"1E:CC:86:95:BE:6F","perSessionID":6,"ivIndex":[0,0,0,0],"keyValue":[126,117,111,44,23,-4,-113,68,-21,-108,26,-49,-113,48,-69,-46],"ivi":false,"nid":102,"ctl":false,"ttl":7,"seq":[0,0,33],"src":[0,22],"dst":[0,18],"transportPDU":[105,-43,-108,-113,88,54,108,105,102],"NetMIC":[-52,-5,90,90],"seg":false,"akf":true,"aid":41,"szmic":false,"transportMIC":[54,108,105,102]},{"messageID":340,"sessionID":29,"type":{"type":"no.nordicsemi.android.mesh.sniffer.storage.traffic.MessageType.Mesh.ACC"},"timestamp":1029,"realTimeStamp":1756362708887,"rawData":[22,42,102,-2,-48,-32,63,67,43,-114,-8,-35,-78,97,112,67,52,57,-102,85,-18,100,-64],"rssi":-60,"deviceName":"Unknown","deviceAddress":"3B:38:1B:FA:38:CB","perSessionID":7,"ivIndex":[0,0,0,0],"keyValue":[126,117,111,44,23,-4,-113,68,-21,-108,26,-49,-113,48,-69,-46],"ivi":false,"nid":102,"ctl":false,"ttl":7,"seq":[0,0,30],"src":[0,18],"dst":[0,22],"transportPDU":[105,-127,-74,61,-102,24,-18,40],"NetMIC":[85,-18,100,-64],"seg":false,"akf":true,"aid":41,"szmic":false,"transportMIC":[-102,24,-18,40]},{"messageID":341,"sessionID":29,"type":{"type":"no.nordicsemi.android.mesh.sniffer.storage.traffic.MessageType.Mesh.ACC"},"timestamp":1052,"realTimeStamp":1756362708910,"rawData":[22,42,102,-2,-48,-32,63,67,43,-114,-8,-35,-78,97,112,67,52,57,-102,85,-18,100,-64],"rssi":-60,"deviceName":"Unknown","deviceAddress":"3B:38:1B:FA:38:CB","perSessionID":8,"ivIndex":[0,0,0,0],"keyValue":[126,117,111,44,23,-4,-113,68,-21,-108,26,-49,-113,48,-69,-46],"ivi":false,"nid":102,"ctl":false,"ttl":7,"seq":[0,0,30],"src":[0,18],"dst":[0,22],"transportPDU":[105,-127,-74,61,-102,24,-18,40],"NetMIC":[85,-18,100,-64],"seg":false,"akf":true,"aid":41,"szmic":false,"transportMIC":[-102,24,-18,40]},{"messageID":342,"sessionID":29,"type":{"type":"no.nordicsemi.android.mesh.sniffer.storage.traffic.MessageType.Mesh.ACC"},"timestamp":1076,"realTimeStamp":1756362708934,"rawData":[22,42,102,-2,-48,-32,63,67,43,-114,-8,-35,-78,97,112,67,52,57,-102,85,-18,100,-64],"rssi":-60,"deviceName":"Unknown","deviceAddress":"3B:38:1B:FA:38:CB","perSessionID":9,"ivIndex":[0,0,0,0],"keyValue":[126,117,111,44,23,-4,-113,68,-21,-108,26,-49,-113,48,-69,-46],"ivi":false,"nid":102,"ctl":false,"ttl":7,"seq":[0,0,30],"src":[0,18],"dst":[0,22],"transportPDU":[105,-127,-74,61,-102,24,-18,40],"NetMIC":[85,-18,100,-64],"seg":false,"akf":true,"aid":41,"szmic":false,"transportMIC":[-102,24,-18,40]}],"advMessages":[],"snbMessages":[],"udbMessages":[],"pbMessages":[],"provMessages":[],"provCompleteMessages":[]}

[Aleksander Nowakowski]

Hi,
We know that the app crashes when sniffing Generic Level Set Unack message due to hash collision.
We also found a number of other issues in parsing, but unfortunately have no resources to have them fixed soon. We are sorry for the inconviencence. We will fix all when only we have a chance, but there are other priorities at the moment.

[Arne M.]

Thanks for the quick response.
Good to hear the rough reason for this problem.
Atm. I managed to weasel around this problem, so no worries.