Wireshark BLE Sniffer missing packet, non-sequential event counter observed

[jasperwong]

I am using Wireshark with Nordic BLE Sniffer plugin. The sniffer dongle used is nRF52840. I using it to capture a BLE connection from my laptop BLE to a peripheral BLE device. 

I observe that the event counter of my BLE communication captured on Wireshark is not incrementing sequentially. I expect that "Event counter" after CONNECT_IND should be 0->1->2->3->..., but I observe that the "Event counter" after CONNECT_IND is 0->2->4->6->8->10->...

May I know why the "Event counter" is not sequentially incrementing? 

The screenshot below starts from Packet No. 4478.

nRF app success, VDD_BLE=2.6V, 100ohm shunt, peripheral_server_sleep_UART, adv_int=500ms, 20260106.pcapng

[Hung Bui]

Hi Jasper, 
Could you try to test on another computer ? 
From what I can see it could be that it's the issue with the Event counter counting , not the issue with the packets. If you look at the NESN and SN you can see that they are fine, no packet missing. For example here is what I have in my capture: 

You can add the delta time (start to start) column to see the distance between packets to see if the packet are actually missing. 

In my case, except for connection event 3 missing, the rest looks fine. The SN of a packet should be equal to the NESN of the last packet. 

I suspect that it could be something wrong with the counting of the event count when transmitting data from the sniffer to PC (event count is not a part of a BLE packet, when SN and NESN are) 

[jasperwong]

As suggested, I used another Windows 11 laptop to plug in the nRF52840 USB Dongle and capture a BLE transaction with Wireshark.

The delta time (start to start) shows the average to be 97ms when event counter is even, but at Packet No. 50699, the gap became 146ms, which is roughly 1.5 times that of 97ms. I think this suggests that packets are indeed lost/overlooked by the nRF52840 Sniffer. 

Assuming my understanding of packet lost is correct, why would the sniffer miss out on BLE packets so consistently (every other event counter)?

nRF app success, VDD_BLE=2.6V, 100ohm shunt, peripheral_server, adv_int=3000ms, 20260107.pcapng

[jasperwong]

Hi Hung,

I bootstraped the Wireshark using `nrfutil ble-sniffer bootstrap`.

I flashed the latest sniffer firmware for nRF52840 USB dongle. I used `nrfutil device program --serial-number ...` with the zip file in the /firmware folder. 

I don't have another dongle or DK on hand. The only dongle I have is PCA10059 2.1.1 2023.46. It is plugged into the laptop's USB port directly. 

[Hung Bui]

Hi Jasper, 

I don't have further idea on what you can try except for trying on another hardware. The sniffer firmware is quite old, last update was about 5-6 years ago. We have little development and maintenance with the sniffer project since then so I don't know if it's the firmware issue or it's the particular hardware you have having issue. 

[jasperwong]

Is the event counter incremented by the NRF BLE Sniffer or the Wireshark software? How is it kept track?

Could you try to capture a BLE connection using the PCA10059 2.1.1 2023.46 and the latest firmware? I would like to know if this is a reproducible problem pertaining to this setup, or is it the particular dongle I got is faulty. 

Do you have suggestions for other more reliable BLE sniffers that would not almost always skip packets?

[Hung Bui]

Hi Jasper, 

Could you try to use nRF Connect for Desktop , switch the dongle to bootloader mode and program the attached file ? 
I use this method and it worked but when using nrfutil with the .zip file I saw the same issue as yours. 
1777.sniffer_nrf52840dongle_nrf52840_4.1.1.hex

[jasperwong]

Hi Hung,

For your reference, this is the zip file I previously flashed onto the nrf52840 USB dongle. I was following the guide from: docs.nordicsemi.com/.../programming_firmware.html

sniffer_nrf52840dongle_nrf52840_4.1.1.zip

[Hung Bui]

Hi Jasper, 
Could you let us know if programming the .hex file worked for you ? 
You need to flash it using nRF Connect for Desktop -> Programmer.