Wireshark BLE Sniffer missing packet, non-sequential event counter observed

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

Hung Bui — Fri, 09 Jan 2026 09:17:10 GMT

Hi Jasper,
I don't have the detail on how the event counter implemented, but from what I can see I think it's just a counter used in the sniffer firmware and count based on the scheduling of the connection event.
I don't think it's very important as what we are seeing here is the actual packet missing, not just event counter is skipped. So there is no issue with the event counter, it's simply we don't know why the sniffer couldn't capture all the packet and skip on packet in between.

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

jasperwong — Thu, 08 Jan 2026 14:05:23 GMT

I was sniffing the traffic between my phone nRF Connect app (Central) and Onsemi RSL10 (Peripheral). I don't have other Nordic DK on hand. Perhaps I can sniff other BLE devices such as wireless mouse or earphones.

May I know what's the difference between the hex file you sent me and the official .zip file? Is there a changelog?

Also, is the Wireshark event counter incremented by the NRF BLE Sniffer or the Wireshark software? How is it kept track?

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

Hung Bui — Thu, 08 Jan 2026 13:48:02 GMT

Hi Jasper,

Which DUT you are sniffing ? Could you try to test with one of our DK (to advertise and get connected) . Which central device do you use ? Could you try to test with another phone if possible ? It could be that the phone has too strict timing causing the problem.

I don't have the same issue, the dongle worked for me most of the time (it's the opposite of what you experience, I only got the same even counter skipping once and then it didnt happen again , with the .zip file, quite strange).

Regarding professional sniffer, most often used AFAIK are Ellisys and Frontline (Teledynelecroy) sniffers.

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

jasperwong — Thu, 08 Jan 2026 08:35:24 GMT

Hi Hung,

The behaviour is quite strange.

I programmed the dongle with the hex you provided.

For the first capture initially, I see sequentially incrementing event counter, which is correct. But later when I did more subsequent captures after saving the first file, the packets are skipped again judging by the event counter. I have attached both the first capture file and the subsequent capture file for your reference.

I am unsure why the new hex file behaves this way. I cannot reproduce capturing the first file which has correct sequential event counter anymore. I kept seeing skipped event counter for all captures except the first one I did after flashing the hex file.

devzone.nordicsemi.com/.../Hung-Bui-sniffer-firmware-Wireshark-log.zip

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

Hung Bui — Thu, 08 Jan 2026 08:16:11 GMT

Hi Jasper,
Could you let us know if programming the .hex file worked for you ?
You need to flash it using nRF Connect for Desktop -> Programmer.

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

jasperwong — Thu, 08 Jan 2026 01:56:54 GMT

Hi Hung,

For your reference, this is the zip file I previously flashed onto the nrf52840 USB dongle. I was following the guide from: docs.nordicsemi.com/.../programming_firmware.html

devzone.nordicsemi.com/.../sniffer_5F00_nrf52840dongle_5F00_nrf52840_5F00_4.1.1.zip

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

Hung Bui — Wed, 07 Jan 2026 15:57:59 GMT

Hi Jasper,

Could you try to use nRF Connect for Desktop , switch the dongle to bootloader mode and program the attached file ?
I use this method and it worked but when using nrfutil with the .zip file I saw the same issue as yours.
devzone.nordicsemi.com/.../1777.sniffer_5F00_nrf52840dongle_5F00_nrf52840_5F00_4.1.1.hex

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

jasperwong — Wed, 07 Jan 2026 15:27:59 GMT

Is the event counter incremented by the NRF BLE Sniffer or the Wireshark software? How is it kept track?

Could you try to capture a BLE connection using the PCA10059 2.1.1 2023.46 and the latest firmware? I would like to know if this is a reproducible problem pertaining to this setup, or is it the particular dongle I got is faulty.

Do you have suggestions for other more reliable BLE sniffers that would not almost always skip packets?

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

Hung Bui — Wed, 07 Jan 2026 14:49:19 GMT

Hi Jasper,

I don't have further idea on what you can try except for trying on another hardware. The sniffer firmware is quite old, last update was about 5-6 years ago. We have little development and maintenance with the sniffer project since then so I don't know if it's the firmware issue or it's the particular hardware you have having issue.

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

jasperwong — Wed, 07 Jan 2026 13:27:25 GMT

Hi Hung,

I bootstraped the Wireshark using `nrfutil ble-sniffer bootstrap`.

I flashed the latest sniffer firmware for nRF52840 USB dongle. I used `nrfutil device program --serial-number ...` with the zip file in the /firmware folder.

I don't have another dongle or DK on hand. The only dongle I have is PCA10059 2.1.1 2023.46. It is plugged into the laptop's USB port directly.

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

Hung Bui — Wed, 07 Jan 2026 12:17:57 GMT

Hi Jasper,
I didn't notice that you uploaded your file in the original question.
From what I can see there the sniffer indeed missing every other connection event. The connection interval in your case is 48.5ms and you are seeing 97ms and 146ms delta time between packets. Meaning there are packet missing in between.

Could you tell which firmware you flashed and how you program it and bootstrap wireshark to use the nRF Sniffer ?

Could you try to test on another dongle/DK ? I assume that you are using a PCA10059 ? Please try avoid using USB hub and connect the dongle directly to PC.

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

jasperwong — Wed, 07 Jan 2026 07:34:05 GMT

As suggested, I used another Windows 11 laptop to plug in the nRF52840 USB Dongle and capture a BLE transaction with Wireshark.

The delta time (start to start) shows the average to be 97ms when event counter is even, but at Packet No. 50699, the gap became 146ms, which is roughly 1.5 times that of 97ms. I think this suggests that packets are indeed lost/overlooked by the nRF52840 Sniffer.

Assuming my understanding of packet lost is correct, why would the sniffer miss out on BLE packets so consistently (every other event counter)?

devzone.nordicsemi.com/.../nRF-app-success_2C00_-VDD_5F00_BLE_3D00_2.6V_2C00_-100ohm-shunt_2C00_-peripheral_5F00_server_2C00_-adv_5F00_int_3D00_3000ms_2C00_-20260107.pcapng

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

jasperwong — Wed, 07 Jan 2026 07:10:26 GMT

Hi Hung,

May I know why would the event counter be wrong? If event counter is not part of a BLE packet, then how does event skip occur? Is the event counter incremented by the NRF BLE Sniffer or the Wireshark software?

RE: Wireshark BLE Sniffer missing packet, non-sequential event counter observed

Hung Bui — Tue, 06 Jan 2026 14:43:43 GMT

Hi Jasper,
Could you try to test on another computer ?
From what I can see it could be that it's the issue with the Event counter counting , not the issue with the packets. If you look at the NESN and SN you can see that they are fine, no packet missing. For example here is what I have in my capture:

You can add the delta time (start to start) column to see the distance between packets to see if the packet are actually missing.

In my case, except for connection event 3 missing, the rest looks fine. The SN of a packet should be equal to the NESN of the last packet.

I suspect that it could be something wrong with the counting of the event count when transmitting data from the sniffer to PC (event count is not a part of a BLE packet, when SN and NESN are)