Sniffing BLE nDFU

RE: Sniffing BLE nDFU

Hieu — Fri, 16 Jan 2026 11:32:14 GMT

Hi Sumit,

I am glad you are able to resolve your issue. These LTK are unique per connections, but maybe it's still a good idea not to share them in a public space.

Then if everything is working fine, please feel free to close this ticket at your convenience.

RE: Sniffing BLE nDFU

Sumit Paropkari — Fri, 16 Jan 2026 10:56:56 GMT

Hello Hieu,

Thank you for your support. We are successfully able to capture DFU Process in the Wireshark. The only Catch is that we have to disconnect and reconnect until we see Flag Encrypted = YES Then we have to start actual DFU.

This is the SC LTK: 0x43bcedd0b9c34906ccd7ce2cf13abed3 at that time. successfully capture Wireshark log you can see that with this link : https://drive.google.com/drive/folders/1PyMsgcf5cmHa2-pMTZ5Wy6GZcBrOr55w?usp=sharing.

RE: Sniffing BLE nDFU

Hieu — Thu, 15 Jan 2026 21:50:22 GMT

Hello Sumit,

You are probably missing some steps. Please refer to the instructions here, in particular, follow step 8 through 10 closely, including the disconnecting and reconnecting.

Exercise 3 - Follow and decrypt a paired connection - Nordic Developer Academy

RE: Sniffing BLE nDFU

Sumit Paropkari — Wed, 14 Jan 2026 13:22:54 GMT

Hello Hieu,

yes, you are correct but i am currently able to capture sniff BLE ADV and connection initiation from Target device and all near by devices in the Wireshark it means Sniffer is working good and also also capturing data in wireshark.

My problem is that when i am try to capture DFU process of a targeted device (mac_id : e3:4d:26:1c:52:c2 ) that is not captured. in the Wireshark due to encryption and no smp packet is captured.

SC LTK: 0x40370a1753f59af41f0f267079363216

you can also verified by Attachment : Contain the Wireshark-log and target device log
drive.google.com/.../1PyMsgcf5cmHa2-pMTZ5Wy6GZcBrOr55w

RE: Sniffing BLE nDFU

Hieu — Wed, 14 Jan 2026 11:56:06 GMT

Hello Sumit,

On the nRF21540 DK, the nRF52840 is connected to a nRF21540 FEM always. The firmware in sniffer_nrf52840dk_nrf52840_4.1.1.hex has no FEM control, so the FEM is most likely in power down all the time and not working. What happens then is that the setup will have very very bad radio performance.

I expect this is the main cause of your issue. Please use another DK or Dongle that is supported by the sniffer.

Hieu

RE: Sniffing BLE nDFU

Sumit Paropkari — Wed, 14 Jan 2026 08:22:51 GMT

Attachment link : :drive.google.com/.../1PyMsgcf5cmHa2-pMTZ5Wy6GZcBrOr55w