nrfutil sniffer not presenting interfaces to Wireshark on Ubuntu Noble

[asabigue]

I am trying to live capture and analyze traffic on Wireshark. I followed lessons like https://academy.nordicsemi.com/courses/bluetooth-low-energy-fundamentals/lessons/lesson-6-bluetooth-le-sniffer/topic/nrf-sniffer-for-bluetooth-le/ unsuccessfully.

Most online documentation for troubleshooting refers to a no longer exiting project called: nRF Sniffer v4.1.1 ZIP

Using current definitions I am able to install and have running command line capture like:

nrfutil ble-sniffer sniff --port /dev/ttyACM0

I understand that I have the right firmware flashed to the device and capturing is working, as the pcap file created can be opened in wireshark.

After installation, I have:

• nrfutil-ble-sniffer-hci-shim
• nrfutil-ble-sniffer-shim
• nrfutil-ble-sniffer-shim-config.json

files copied to .local/lib/wireshark/extcap and verified that wireshark is using that folder for personal extcap

The problem is that wireshark shows no interface associated to nRF bluetooth .

If I run ./nrfutil-ble-sniffer-shim --extcap-interfaces I get no output and running it with sudo:

asabigue@devel:~/.local/lib/wireshark/extcap$ sudo ./nrfutil-ble-sniffer-shim --extcap-interfaces
[sudo] contraseña para asabigue:

thread 'main' panicked at src/main.rs:1856:68:
called `Option::unwrap()` on a `None` value
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
Error: Subprocess /root/.nrfutil/bin/nrfutil-ble-sniffer failed with unexpected exit code Some(101)

Please provide further tests, ideas or solutions in order to properly connect wireshark to the sniffer.

Thanks!

[Benjamin]

Hi Ariel,

Which hardware and firmware are you using? The BLE interface will only appear if the correct firmware is flashed and the board is connected to your computer.

Regards,
Benjamin

[asabigue]

Thank you for your answer. I believe all that is Ok as I am able to run nrfutil ble-sniffer sniff --port /dev/ttyACM successfully.

The device I am using is anRF52840 DK:

asabigue@devel:~$ nrfutil device list
105*****9
Product J-Link
Board version PCA10056
Ports /dev/ttyACM0, vcom: 0
/dev/ttyACM1, vcom: 1
Traits devkit, jlink, seggerUsb, serialPorts, usb

Supported devices found: 1

and the firmware I am running is:nrfutil-ble-sniffer/firmware/sniffer_nrf52840dk_nrf52840_4.1.1.hex

you may see this output, that seems a proper output of a capture:

nrfutil ble-sniffer sniff --port /dev/ttyACM0 --log-output stdout --json-pretty

{
"type": "log",
"data": {
"level": "INFO",
"message": "nrfutil-ble-sniffer (version = 0.17.1, platform = x86_64-unknown-linux-gnu, classification = nrf-external) invoked with sniff --port /dev/ttyACM0 --log-output stdout --json-pretty ",
"timestamp": "2025-12-30T11:13:23.879Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Attempt opening serial port at /dev/ttyACM0",
"timestamp": "2025-12-30T11:13:23.880Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Subscribing to event DEVICE_ADDED",
"timestamp": "2025-12-30T11:13:23.881Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Sending version request",
"timestamp": "2025-12-30T11:13:23.881Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Sending ping request",
"timestamp": "2025-12-30T11:13:23.881Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Sending timestamp request",
"timestamp": "2025-12-30T11:13:23.881Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Sending advertisement hop sequence request for channels [37, 38, 39]",
"timestamp": "2025-12-30T11:13:23.881Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Changing state from IDLE to SCANNING",
"timestamp": "2025-12-30T11:13:23.882Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Sending scan packet",
"timestamp": "2025-12-30T11:13:23.882Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Sending request to use temporary key [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]",
"timestamp": "2025-12-30T11:13:23.882Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Device added: {\"address\":{\"address\":\"7f:ce:db:7e:eb:b4\",\"type\":\"Random\"},\"name\":null,\"rssi\":-60,\"is_followed\":false}",
"timestamp": "2025-12-30T11:13:23.883Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Device added: {\"address\":{\"address\":\"e0:49:99:a8:49:9e\",\"type\":\"Random\"},\"name\":null,\"rssi\":-55,\"is_followed\":false}",
"timestamp": "2025-12-30T11:13:23.883Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Device added: {\"address\":{\"address\":\"2e:98:70:e8:15:f4\",\"type\":\"Random\"},\"name\":null,\"rssi\":-54,\"is_followed\":false}",
"timestamp": "2025-12-30T11:13:23.884Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Device added: {\"address\":{\"address\":\"3c:5e:59:88:3b:88\",\"type\":\"Random\"},\"name\":null,\"rssi\":-63,\"is_followed\":false}",
"timestamp": "2025-12-30T11:13:23.886Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Device added: {\"address\":{\"address\":\"20:7:d6:0:6f:4c\",\"type\":\"Random\"},\"name\":null,\"rssi\":-67,\"is_followed\":false}",
"timestamp": "2025-12-30T11:13:23.887Z"
}
}
{
"type": "log",
"data": {
"level": "INFO",
"message": "Device added: {\"address\":{\"address\":\"31:6f:7f:d2:69:80\",\"type\":\"Random\"},\"name\":null,\"rssi\":-54,\"is_followed\":false}",
"timestamp": "2025-12-30T11:13:23.889Z"
}
}

[Benjamin]

Thanks,
What version of the nrfutil-ble-sniffer do you have?  The 0.17.1 release fixes an issue similar to what you are experiencing.

Regards,
Benjamin

[asabigue]

~/.nrfutil# nrfutil list
Command Version Description
ble-sniffer 0.17.1 Bluetooth Low Energy (Bluetooth LE) sniffer for Nordic Semiconductor devices.

[Benjamin]

Did you connect it with the nRF USB port or the IMCU USB port?