• State Not Answered
  • Replies 5 replies
  • Subscribers 86 subscribers
  • Views 422 views
  • Users 0 members are here
Attachments (0)
Nordic Case Info
  • Case ID: 357051
Options

Anonymous advertising packets in long nRF52840 BLE sniffer sessions cause device/MAC address filtering to fail

kp88

Wireshark Version 4.6.2
nrf_sniffer_for_bluetooth_le_4.1.1

I am trying to capture packets from a long BLE session using Wireshark and the nRF52840 BLE sniffer. Most times this works great and has been super helpful to development and debugging. However, while recently debugging connections between the target embedded peripheral and an Android host, I found the sniffer is also tracing "anonymous" extended advertising packets coming from the Android host despite explicitly setting the device/MAC address filtering.

I understand that I can filter out the extended advertising packets with a display filter but I am finding that eventually (after a few hours of continuous capture), peripheral specific packets are no longer captured even though for sure there is on-going traffic.  I don't understand the root cause of this bug but I can say that tracing long sessions with other hosts that don't continuously send extended advertising packets has worked well.   In other words, the anonymous extended advertising packets appear to "overrun" and/or cause MAC address filtering to fail.  

Is there any way to exclude the extended advertising packets from the initial capture?

Below is what a typical session looks like with the device filter set to "00:18:80:ff:9e:b1 public".  

What starts with:

No. Time Source Destination Protocol Length Info
1141 26.599660 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
1142 26.600001 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
1143 26.669038 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
1144 26.669540 46:48:40:fd:1c:bf 00:18:80:ff:9e:b1 LE LL 38 SCAN_REQ
1145 26.669866 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 57 SCAN_RSP
1146 26.670687 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
1147 26.671769 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
1148 26.864814 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
1149 26.865897 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
1150 26.866979 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
1151 26.953076 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
1152 26.953417 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
1153 26.953757 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
1154 27.056839 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
1155 27.057922 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
1156 27.058424 46:48:40:fd:1c:bf 00:18:80:ff:9e:b1 LE LL 60 CONNECT_IND
1157 27.090578 Central_... Peripheral_... LE LL 35 Control Opcode: LL_FEATURE_REQ
1158 27.090880 Peripheral_... Central_... LE LL 35 Control Opcode: LL_LENGTH_REQ
1159 27.135579 Central_... Peripheral_... LE LL 35 Control Opcode: LL_LENGTH_RSP
1160 27.135881 Peripheral_... Central_... LE LL 35 Control Opcode: LL_FEATURE_RSP

eventually ends up with nothing but this:

No. Time Source Destination Protocol Length Info
80709 7872.118853 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
80710 7872.403175 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
80711 7872.403516 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
80712 7872.403857 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
80713 7872.689428 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
80714 7872.689769 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
80715 7872.690110 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
80716 7872.979432 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
80717 7872.979773 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
80718 7872.980114 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
80719 7873.266937 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
80720 7873.267278 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
80721 7873.267619 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND

Thanks in advance for any suggestions.

Kevin

  • 0

    Hi,

    Based on the limited number of log lines that you provided, it does look like the rate of "Anonymous" transmissions stays the same, but after a couple of hours all other transmissions are missing from the sniffer trace? Will they reappear if you restart the sniffing, and what would be the steps to reproduce the issue?

    Regards,
    Terje

  • 0 in reply to tesc

    Hi, thank you for the reply!

    Yes, stopping and starting Wireshark capture and resetting the device/MAC address capture filter will restore functionality for a while but it eventually ends up in the same state.  And yes, in this state all packets from normal peripheral advertising and host-peripheral connections are missing.

    Would a full .pcapng log be helpful?

    As for reproducing the issue, it is currently tied up in my test environment running a Samsung/Android host against an ADI/MAX32666FTHR peripheral, so not super easy to recreate.  The basic structure consists of running 100s of repeats of 20s connections between the host and peripheral where each connection consists of periodic (1 second) notifications from the peripheral.  I have confirmed that the anonymous extended advertising packets are coming from the Samsung/Android host but I don't understand which application/service is sending them.  My guess is something related to Android's mechanism for device discovery.

    I could work to pair down the test env to something simpler if that would be helpful, e.g. using nRF52840 dongles all the way around, but that will take a little time.

  • 0

    I have learned a few more things about this issue since posting.

    The first observation is that it is not uncommon for the sniffer to lose sync and when in this state the LED on the nrf52840dongle flickers green instead of red and it reports LL traffic as Anonymous ADV_EXT_IND.  

    For example, in the first 20 repeats of another test run with the same test conditions as above, I see the following in the logs:

    Connect Events:

    • Periph 'Connection opened': 20
    • Central 'connect to': 20
    • Sniff CONNECT_IND: 15

    'Sniff Timestamp' is calculated by aligning the first CONNECT_IND packet with central 'connect to' timestamp to determine sniff start time.

    'Delta' is Periph - Sniff in milliseconds (positive = Periph later than Sniff)

    Run Central Timestamp Sniff Packet Sniff Time Sniff Timestamp Periph Timestamp Delta (ms) Status
    1 09:59:30.468 2957 9.202s 09:59:30.468 09:59:30.582 114.5
    2 10:00:29.380 4481 68.073s 10:00:29.339 10:00:29.452 113.1
    3 10:01:30.655 6425 129.373s 10:01:30.639 10:01:30.751 111.7
    4 10:02:31.999 8356 190.724s 10:02:31.990 10:02:32.100 110.4
    5 10:03:33.192 9906 252.108s 10:03:33.374 10:03:33.483 108.8
    6 10:04:34.307 11430 313.403s 10:04:34.669 10:04:34.776 107.2
    7 10:05:35.536 12945 374.447s 10:05:35.713 10:05:35.819 105.8
    8 10:06:36.679 --- --- --- 10:06:36.965 --- MISSING
    9 10:07:37.851 15726 496.949s 10:07:38.215 10:07:38.318 102.9
    10 10:08:38.994 17292 557.722s 10:08:38.987 10:08:39.089 101.5
    11 10:09:40.114 18850 619.222s 10:09:40.488 10:09:40.588 100.0
    12 10:10:41.323 --- --- --- 10:10:41.604 --- MISSING
    13 10:11:42.461 21588 741.570s 10:11:42.835 10:11:42.932 97.0
    14 10:12:44.013 23135 802.753s 10:12:44.019 10:12:44.114 95.6
    15 10:13:44.984 25052 863.909s 10:13:45.175 10:13:45.269 94.0
    16 10:14:46.194 26967 925.116s 10:14:46.382 10:14:46.474 92.6
    17 10:15:47.582 --- --- --- 10:15:47.681 --- MISSING
    18 10:16:48.660 --- --- --- 10:16:48.923 --- MISSING
    19 10:17:50.050 --- --- --- 10:17:50.324 --- MISSING
    20 10:18:51.304 31396 1170.228s 10:18:51.494 10:18:51.570 75.8

    For those connections where the sniff trace is missing the CONNECT_IND packets, the sniffer is reporting:

    No. Time Source Destination Protocol Length Info
    14493 435.209332 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
    14494 435.209835 54:dd:91:ed:a4:0e 00:18:80:ff:9e:b1 LE LL 38 SCAN_REQ
    14495 435.210161 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 57 SCAN_RSP
    14496 435.400442 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
    14497 435.401525 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
    14498 435.402607 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
    14499 435.502148 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
    14500 435.502489 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
    14501 435.783063 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
    .
    .
    .
    14730 458.434650 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
    14731 458.434991 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
    14732 458.435332 Anonymous ff:ff:ff:ff:ff:ff LE LL 33 ADV_EXT_IND
    14733 458.479574 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND
    14734 458.480657 00:18:80:ff:9e:b1 ff:ff:ff:ff:ff:ff LE LL 60 ADV_IND

    The second thing I've learned about this issue is that it depends heavily on the behavior of the Samsung/Android tablet.  I have ported everything (central, peripheral, central-with-extended-advertising) to nrf52840dongle targets and though I do see the occasional loss of sync as shown above, the sniffer never ends up stuck out of sync for extended periods.

    One more thing - in addition to getting stuck capturing/reporting anonymous extended advertising packets despite on-going LL traffic, I have also seen the sniffer get completely wedged.  In this state it doesn't forward anything to Wireshark and there are no LEDs illuminated on the nrf52840dongle.  This may be another issue altogether but it seems related to me.

    To help you recreate this issue I can upload a peripheral .zip (built for nrf52840dongle/nrf52840) and an android .apk for a central target - please confirm that you have the tools/hardware available to install and run the android target.

    Just FYI, here is a depiction of the test setup for the test run described above:

    And here is the complete summary of the connect events for the entire run:

    Connect events:

    • Periph 'Connection opened': 200
    • Central 'connect to': 200
    • Sniff CONNECT_IND: 60

    'Sniff Timestamp' is calculated by aligning the first CONNECT_IND packet with central entry 1 'connect to' timestamp to determine sniff start time.

    'Delta' is Periph - Sniff in milliseconds (positive = Periph later than Sniff)

    Run Central Timestamp Sniff Packet Sniff Time Sniff Timestamp Periph Timestamp Delta (ms) Status
    1 09:59:30.468 2957 9.202s 09:59:30.468 09:59:30.582 114.5
    2 10:00:29.380 4481 68.073s 10:00:29.339 10:00:29.452 113.1
    3 10:01:30.655 6425 129.373s 10:01:30.639 10:01:30.751 111.7
    4 10:02:31.999 8356 190.724s 10:02:31.990 10:02:32.100 110.4
    5 10:03:33.192 9906 252.108s 10:03:33.374 10:03:33.483 108.8
    6 10:04:34.307 11430 313.403s 10:04:34.669 10:04:34.776 107.2
    7 10:05:35.536 12945 374.447s 10:05:35.713 10:05:35.819 105.8
    8 10:06:36.679 --- --- --- 10:06:36.965 --- MISSING
    9 10:07:37.851 15726 496.949s 10:07:38.215 10:07:38.318 102.9
    10 10:08:38.994 17292 557.722s 10:08:38.987 10:08:39.089 101.5
    11 10:09:40.114 18850 619.222s 10:09:40.488 10:09:40.588 100.0
    12 10:10:41.323 --- --- --- 10:10:41.604 --- MISSING
    13 10:11:42.461 21588 741.570s 10:11:42.835 10:11:42.932 97.0
    14 10:12:44.013 23135 802.753s 10:12:44.019 10:12:44.114 95.6
    15 10:13:44.984 25052 863.909s 10:13:45.175 10:13:45.269 94.0
    16 10:14:46.194 26967 925.116s 10:14:46.382 10:14:46.474 92.6
    17 10:15:47.582 --- --- --- 10:15:47.681 --- MISSING
    18 10:16:48.660 --- --- --- 10:16:48.923 --- MISSING
    19 10:17:50.050 --- --- --- 10:17:50.324 --- MISSING
    20 10:18:51.304 31396 1170.228s 10:18:51.494 10:18:51.570 75.8
    21 10:19:52.417 --- --- --- 10:19:52.873 --- MISSING
    22 10:20:53.734 34148 1292.666s 10:20:53.932 10:20:54.004 72.5
    23 10:21:54.982 --- --- --- 10:21:55.625 --- MISSING
    24 10:22:56.394 36926 1415.326s 10:22:56.592 10:22:56.661 69.0
    25 10:23:57.462 38496 1476.401s 10:23:57.666 10:23:57.734 67.4
    26 10:24:58.515 40021 1537.444s 10:24:58.710 10:24:58.776 65.7
    27 10:26:00.088 41953 1599.026s 10:26:00.291 10:26:00.355 63.8
    28 10:27:01.208 42987 1659.943s 10:27:01.209 10:27:01.271 62.2
    29 10:28:02.347 44182 1721.649s 10:28:02.915 10:28:02.975 60.5
    30 10:29:03.659 --- --- --- 10:29:03.734 --- MISSING
    31 10:30:04.905 45820 1843.664s 10:30:04.929 10:30:04.986 57.1
    32 10:31:06.043 46843 1904.982s 10:31:06.247 10:31:06.303 55.5
    33 10:32:07.214 47639 1966.351s 10:32:07.616 10:32:07.670 53.7
    34 10:33:08.552 48477 2027.324s 10:33:08.589 10:33:08.641 52.1
    35 10:34:09.469 49814 2088.233s 10:34:09.498 10:34:09.549 50.4
    36 10:35:10.523 50910 2149.651s 10:35:10.917 10:35:10.965 48.8
    37 10:36:12.115 --- --- --- 10:36:12.184 --- MISSING
    38 10:37:13.359 52915 2272.111s 10:37:13.377 10:37:13.422 45.4
    39 10:38:14.683 54387 2333.451s 10:38:14.716 10:38:14.760 43.8
    40 10:39:15.934 --- --- --- 10:39:16.016 --- MISSING
    41 10:40:16.827 --- --- --- 10:40:16.894 --- MISSING
    42 10:41:18.095 56699 2516.857s 10:41:18.123 10:41:18.162 38.8
    43 10:42:19.311 57304 2578.648s 10:42:19.913 10:42:19.951 37.2
    44 10:43:20.198 --- --- --- 10:43:20.442 --- MISSING
    45 10:44:21.403 59204 2700.363s 10:44:21.629 10:44:21.663 34.1
    46 10:45:22.630 60158 2761.409s 10:45:22.675 10:45:22.707 32.4
    47 10:46:23.858 61360 2822.816s 10:46:24.081 10:46:24.112 30.6
    48 10:47:25.566 62705 2884.344s 10:47:25.610 10:47:25.639 28.9
    49 10:48:26.097 63646 2945.049s 10:48:26.314 10:48:26.342 27.4
    50 10:49:27.313 64685 3006.277s 10:49:27.543 10:49:27.569 25.6
    51 10:50:28.473 66146 3067.435s 10:50:28.701 10:50:28.725 24.0
    52 10:51:29.743 67149 3128.517s 10:51:29.783 10:51:29.860 77.2
    53 10:52:30.972 67959 3189.934s 10:52:31.199 10:52:31.276 77.0
    54 10:53:32.147 68702 3250.921s 10:53:32.187 10:53:32.263 76.6
    55 10:54:33.476 69779 3312.439s 10:54:33.705 10:54:33.781 76.2
    56 10:55:34.522 70419 3373.308s 10:55:34.574 10:55:34.649 75.8
    57 10:56:35.645 --- --- --- 10:56:36.152 --- MISSING
    58 10:57:36.971 72382 3495.948s 10:57:37.214 10:57:37.289 75.0
    59 10:58:37.910 --- --- --- 10:58:38.033 --- MISSING
    60 10:59:38.814 --- --- --- 10:59:38.905 --- MISSING
    61 11:00:40.171 --- --- --- 11:00:40.310 --- MISSING
    62 11:01:41.503 75948 3740.296s 11:01:41.562 11:01:41.636 73.6
    63 11:02:42.746 --- --- --- 11:02:43.056 --- MISSING
    64 11:03:43.924 77448 3862.903s 11:03:44.169 11:03:44.241 72.8
    65 11:04:44.871 78899 3924.039s 11:04:45.305 11:04:45.377 72.5
    66 11:05:46.198 79995 3984.990s 11:05:46.256 11:05:46.328 72.2
    67 11:06:47.280 80648 4046.075s 11:06:47.340 11:06:47.412 71.7
    68 11:07:48.537 81263 4107.515s 11:07:48.781 11:07:48.852 71.3
    69 11:08:49.516 82391 4169.084s 11:08:50.349 11:08:50.420 71.0
    70 11:09:50.661 83432 4229.644s 11:09:50.909 11:09:50.980 70.6
    71 11:10:51.920 84412 4291.292s 11:10:52.558 11:10:52.628 70.3
    72 11:11:53.304 85547 4352.068s 11:11:53.334 11:11:53.404 70.0
    73 11:12:54.534 86253 4413.332s 11:12:54.597 11:12:54.667 69.5
    74 11:13:55.681 86872 4474.672s 11:13:55.937 11:13:56.007 69.2
    75 11:14:56.675 --- --- --- 11:14:57.000 --- MISSING
    76 11:15:57.844 88398 4596.648s 11:15:57.914 11:15:57.982 68.4
    77 11:16:59.323 --- --- --- 11:16:59.465 --- MISSING
    78 11:18:00.385 --- --- --- 11:18:00.701 --- MISSING
    79 11:19:01.725 --- --- --- 11:19:01.858 --- MISSING
    80 11:20:02.667 --- --- --- 11:20:03.180 --- MISSING
    81 11:21:04.029 --- --- --- 11:21:04.182 --- MISSING
    82 11:22:05.340 --- --- --- 11:22:05.481 --- MISSING
    83 11:23:06.196 --- --- --- 11:23:06.496 --- MISSING
    84 11:24:07.533 --- --- --- 11:24:07.680 --- MISSING
    85 11:25:08.592 --- --- --- 11:25:08.738 --- MISSING
    86 11:26:09.411 --- --- --- 11:26:09.710 --- MISSING
    87 11:27:11.176 --- --- --- 11:27:12.068 --- MISSING
    88 11:28:12.347 --- --- --- 11:28:12.648 --- MISSING
    89 11:29:13.355 --- --- --- 11:29:13.841 --- MISSING
    90 11:30:14.771 --- --- --- 11:30:14.885 --- MISSING
    91 11:31:15.658 --- --- --- 11:31:15.953 --- MISSING
    92 11:32:17.118 --- --- --- 11:32:17.608 --- MISSING
    93 11:33:18.186 --- --- --- 11:33:18.483 --- MISSING
    94 11:34:19.258 --- --- --- 11:34:19.743 --- MISSING
    95 11:35:20.438 --- --- --- 11:35:20.732 --- MISSING
    96 11:36:21.670 --- --- --- 11:36:21.785 --- MISSING
    97 11:37:22.858 --- --- --- 11:37:23.340 --- MISSING
    98 11:38:24.109 --- --- --- 11:38:25.362 --- MISSING
    99 11:39:25.213 --- --- --- 11:39:25.506 --- MISSING
    100 11:40:26.325 --- --- --- 11:40:26.627 --- MISSING
    101 11:41:27.654 --- --- --- 11:41:27.760 --- MISSING
    102 11:42:28.920 --- --- --- 11:42:29.217 --- MISSING
    103 11:43:30.052 --- --- --- 11:43:30.346 --- MISSING
    104 11:44:31.030 --- --- --- 11:44:31.525 --- MISSING
    105 11:45:32.254 --- --- --- 11:45:32.558 --- MISSING
    106 11:46:33.497 --- --- --- 11:46:33.981 --- MISSING
    107 11:47:34.887 --- --- --- 11:47:35.173 --- MISSING
    108 11:48:36.220 --- --- --- 11:48:36.701 --- MISSING
    109 11:49:37.535 --- --- --- 11:49:37.833 --- MISSING
    110 11:50:38.530 --- --- --- 11:50:39.026 --- MISSING
    111 11:51:39.733 --- --- --- 11:51:40.031 --- MISSING
    112 11:52:41.268 --- --- --- 11:52:41.382 --- MISSING
    113 11:53:42.203 --- --- --- 11:53:42.495 --- MISSING
    114 11:54:43.376 --- --- --- 11:54:43.666 --- MISSING
    115 11:55:44.465 --- --- --- 11:55:44.767 --- MISSING
    116 11:56:45.603 --- --- --- 11:56:46.077 --- MISSING
    117 11:57:47.143 --- --- --- 11:57:47.441 --- MISSING
    118 11:58:48.806 --- --- --- 11:58:48.915 --- MISSING
    119 11:59:49.525 --- --- --- 11:59:49.629 --- MISSING
    120 12:00:50.638 --- --- --- 12:00:50.957 --- MISSING
    121 12:01:51.790 --- --- --- 12:01:52.473 --- MISSING
    122 12:02:53.792 --- --- --- 12:02:54.098 --- MISSING
    123 12:03:56.074 --- --- --- 12:03:56.767 --- MISSING
    124 12:04:57.022 --- --- --- 12:04:57.522 --- MISSING
    125 12:05:58.245 --- --- --- 12:05:58.376 --- MISSING
    126 12:06:59.145 --- --- --- 12:06:59.653 --- MISSING
    127 12:08:00.166 --- --- --- 12:08:00.656 --- MISSING
    128 12:09:01.883 --- --- --- 12:09:02.983 --- MISSING
    129 12:10:03.027 --- --- --- 12:10:03.157 --- MISSING
    130 12:11:04.210 --- --- --- 12:11:04.527 --- MISSING
    131 12:12:05.293 --- --- --- 12:12:05.617 --- MISSING
    132 12:13:06.205 --- --- --- 12:13:06.339 --- MISSING
    133 12:14:07.885 --- --- --- 12:14:08.198 --- MISSING
    134 12:15:08.979 --- --- --- 12:15:09.292 --- MISSING
    135 12:16:09.967 --- --- --- 12:16:10.655 --- MISSING
    136 12:17:11.205 --- --- --- 12:17:11.525 --- MISSING
    137 12:18:12.058 --- --- --- 12:18:12.569 --- MISSING
    138 12:19:13.726 --- --- --- 12:19:13.858 --- MISSING
    139 12:20:14.810 --- --- --- 12:20:15.324 --- MISSING
    140 12:21:15.832 --- --- --- 12:21:16.150 --- MISSING
    141 12:22:17.058 --- --- --- 12:22:17.379 --- MISSING
    142 12:23:18.355 --- --- --- 12:23:18.682 --- MISSING
    143 12:24:19.356 --- --- --- 12:24:19.488 --- MISSING
    144 12:25:20.611 --- --- --- 12:25:20.934 --- MISSING
    145 12:26:21.823 --- --- --- 12:26:22.148 --- MISSING
    146 12:27:23.033 --- --- --- 12:27:23.177 --- MISSING
    147 12:28:24.180 --- --- --- 12:28:24.306 --- MISSING
    148 12:29:25.763 --- --- --- 12:29:26.273 --- MISSING
    149 12:30:26.893 --- --- --- 12:30:27.192 --- MISSING
    150 12:31:28.101 --- --- --- 12:31:28.772 --- MISSING
    151 12:32:29.248 --- --- --- 12:32:29.348 --- MISSING
    152 12:33:30.836 --- --- --- 12:33:31.330 --- MISSING
    153 12:34:32.387 --- --- --- 12:34:32.865 --- MISSING
    154 12:35:33.778 --- --- --- 12:35:34.064 --- MISSING
    155 12:36:34.878 --- --- --- 12:36:35.158 --- MISSING
    156 12:37:35.967 --- --- --- 12:37:36.434 --- MISSING
    157 12:38:37.378 --- --- --- 12:38:37.476 --- MISSING
    158 12:39:38.552 --- --- --- 12:39:38.651 --- MISSING
    159 12:40:39.664 --- --- --- 12:40:40.133 --- MISSING
    160 12:41:41.013 --- --- --- 12:41:41.487 --- MISSING
    161 12:42:42.295 --- --- --- 12:42:42.580 --- MISSING
    162 12:43:43.289 --- --- --- 12:43:43.932 --- MISSING
    163 12:44:44.723 --- --- --- 12:44:44.812 --- MISSING
    164 12:45:45.953 --- --- --- 12:45:46.408 --- MISSING
    165 12:46:46.867 --- --- --- 12:46:47.140 --- MISSING
    166 12:47:48.128 --- --- --- 12:47:48.595 --- MISSING
    167 12:48:49.536 --- --- --- 12:48:50.016 --- MISSING
    168 12:49:50.566 --- --- --- 12:49:51.033 --- MISSING
    169 12:50:51.710 --- --- --- 12:50:51.988 --- MISSING
    170 12:51:52.880 --- --- --- 12:51:53.165 --- MISSING
    171 12:52:53.866 --- --- --- 12:52:53.955 --- MISSING
    172 12:53:55.154 --- --- --- 12:53:55.246 --- MISSING
    173 12:54:56.811 --- --- --- 12:54:57.090 --- MISSING
    174 12:55:57.824 --- --- --- 12:55:58.070 --- MISSING
    175 12:56:59.256 --- --- --- 12:57:00.122 --- MISSING
    176 12:58:00.190 --- --- --- 12:58:00.646 --- MISSING
    177 12:59:01.447 --- --- --- 12:59:02.877 --- MISSING
    178 13:00:02.940 152047 10842.034s 13:00:03.300 13:00:03.214 -86.7
    179 13:01:04.330 152848 10903.427s 13:01:04.693 13:01:04.605 -88.1
    180 13:02:05.469 --- --- --- 13:02:05.748 --- MISSING
    181 13:03:06.645 --- --- --- 13:03:07.279 --- MISSING
    182 13:04:08.090 --- --- --- 13:04:08.400 --- MISSING
    183 13:05:09.156 --- --- --- 13:05:09.478 --- MISSING
    184 13:06:10.504 --- --- --- 13:06:10.807 --- MISSING
    185 13:07:11.796 --- --- --- 13:07:12.117 --- MISSING
    186 13:08:13.043 --- --- --- 13:08:13.369 --- MISSING
    187 13:09:15.004 --- --- --- 13:09:15.328 --- MISSING
    188 13:10:16.344 --- --- --- 13:10:16.473 --- MISSING
    189 13:11:17.543 --- --- --- 13:11:17.676 --- MISSING
    190 13:12:19.117 --- --- --- 13:12:20.034 --- MISSING
    191 13:13:20.051 --- --- --- 13:13:20.943 --- MISSING
    192 13:14:21.077 --- --- --- 13:14:21.408 --- MISSING
    193 13:15:23.289 --- --- --- 13:15:23.787 --- MISSING
    194 13:16:24.424 --- --- --- 13:16:25.105 --- MISSING
    195 13:17:25.626 --- --- --- 13:17:25.757 --- MISSING
    196 13:18:26.874 --- --- --- 13:18:27.379 --- MISSING
    197 13:19:27.971 --- --- --- 13:19:28.655 --- MISSING
    198 13:20:29.110 --- --- --- 13:20:29.428 --- MISSING
    199 13:21:30.229 --- --- --- 13:21:30.739 --- MISSING
    200 13:22:31.259 --- --- --- 13:22:31.957 --- MISSING
  • 0 in reply to kp88

    Hi,

    Thank you for the updates. Your insights are appreciated.

    Let us check if what you have is something we can use to reproduce locally. In any case we would be able to look at the full .pcapng, so that one could be very useful, yes.

    If with the .apk we manage to reproduce the behavior you are seeing, then we may be better positioned for improving the performance of the sniffer. If you don't want to share it here in a public ticket, then please either create a private ticket and share it there, or I can turn this one private (if so then please let me know.)

    Regards,
    Terje

  • 0 in reply to tesc

    Hi, thank you for your reply.  One more detail I just learned this morning - disabling WiFi on the Samsung tablet stops the Anonymous advertising packets.  For sure the tablet is connecting in the 5GHz WiFi band so this is quite surprising to me.  Either way, it would be great if the sniffer could be made robust enough to weather the disruption, whatever the source.

    I will create a private ticket to upload the apps and logs.

Related
Terms of service