Sniffing BLE nDFU

[Sumit Paropkari]

i am performing DFU process b/w nrf54l15 and nrf connect mobile_app ( Android ) and i am sniffing the it using nrf54840 soc and the bord is nrf21540dk in Wireshark 

i know DFU process uses pairing for security, mtu exchange then firmware is divided into chunks and chunk is send to target device use the SMP Protocol + CBOR for actual packet transfer 

Target Device MAC_id : e3:4d:26:1c:52:c2

sniffing firmware = sniffer_nrf52840dk_nrf52840_4.1.1.hex 

DFU is working perfectely fine and it also updgrading Firmware of target device.

The ISSUE is the sniffer is not sniffing DFU process i also added the SC LTK in the wireshark 

[00:02:53.895,699] <inf> Lesson5_Exercise1: Passkey for 76:81:6B:E1:C7:F8 (random): 548220

[00:03:14.145,860] <inf> Lesson5_Exercise1: Security changed: 76:81:6B:E1:C7:F8 (random) level 4

[00:03:14.266,122] <inf> bt_keys: SC LTK: 0x40370a1753f59af41f0f267079363216

please find attachment for Wireshark-log and target device log

[Sumit Paropkari]

Attachment link : :drive.google.com/.../1PyMsgcf5cmHa2-pMTZ5Wy6GZcBrOr55w

[Hieu]

Hello Sumit,

On the nRF21540 DK, the nRF52840 is connected to a nRF21540 FEM always. The firmware in sniffer_nrf52840dk_nrf52840_4.1.1.hex has no FEM control, so the FEM is most likely in power down all the time and not working. What happens then is that the setup will have very very bad radio performance.

I expect this is the main cause of your issue. Please use another DK or Dongle that is supported by the sniffer.

Hieu

[Sumit Paropkari]

Hello Hieu,

yes, you are correct but i am currently able to capture sniff  BLE ADV and connection initiation from Target device and all near by devices in the Wireshark it means Sniffer is working good and also also capturing data in wireshark.

My problem is that when i am try to capture DFU process of a targeted device (mac_id : e3:4d:26:1c:52:c2 ) that is not captured. in the Wireshark due to encryption and no smp packet is captured.

SC LTK: 0x40370a1753f59af41f0f267079363216

you can also verified by Attachment : Contain the Wireshark-log and target device log
drive.google.com/.../1PyMsgcf5cmHa2-pMTZ5Wy6GZcBrOr55w

[Hieu]

Hello Sumit,

You are probably missing some steps. Please refer to the instructions here, in particular, follow step 8 through 10 closely, including the disconnecting and reconnecting.

Exercise 3 - Follow and decrypt a paired connection - Nordic Developer Academy

[Sumit Paropkari]

Hello Hieu,

Thank you for your support. We are successfully able to capture DFU Process in the Wireshark. The only Catch is that we have to disconnect and reconnect until we see Flag Encrypted = YES  Then we have to start actual DFU.

This is the SC LTK: 0x43bcedd0b9c34906ccd7ce2cf13abed3 at that time. successfully capture Wireshark log you can see that with this link : https://drive.google.com/drive/folders/1PyMsgcf5cmHa2-pMTZ5Wy6GZcBrOr55w?usp=sharing.