RE: Anonymous advertising packets in long nRF52840 BLE sniffer sessions cause device/MAC address filtering to fail

kp88 — Wed, 18 Feb 2026 20:12:32 GMT

Hi, thank you for your reply. One more detail I just learned this morning - disabling WiFi on the Samsung tablet stops the Anonymous advertising packets. For sure the tablet is connecting in the 5GHz WiFi band so this is quite surprising to me. Either way, it would be great if the sniffer could be made robust enough to weather the disruption, whatever the source.

I will create a private ticket to upload the apps and logs.

RE: Anonymous advertising packets in long nRF52840 BLE sniffer sessions cause device/MAC address filtering to fail

tesc — Wed, 18 Feb 2026 15:56:02 GMT

Hi,

Thank you for the updates. Your insights are appreciated.

Let us check if what you have is something we can use to reproduce locally. In any case we would be able to look at the full .pcapng, so that one could be very useful, yes.

If with the .apk we manage to reproduce the behavior you are seeing, then we may be better positioned for improving the performance of the sniffer. If you don't want to share it here in a public ticket, then please either create a private ticket and share it there, or I can turn this one private (if so then please let me know.)

Regards,
Terje

RE: Anonymous advertising packets in long nRF52840 BLE sniffer sessions cause device/MAC address filtering to fail

kp88 — Fri, 13 Feb 2026 17:54:43 GMT

I have learned a few more things about this issue since posting.

The first observation is that it is not uncommon for the sniffer to lose sync and when in this state the LED on the nrf52840dongle flickers green instead of red and it reports LL traffic as Anonymous ADV_EXT_IND.

For example, in the first 20 repeats of another test run with the same test conditions as above, I see the following in the logs:

Connect Events:

Periph 'Connection opened': 20
Central 'connect to': 20
Sniff CONNECT_IND: 15

'Sniff Timestamp' is calculated by aligning the first CONNECT_IND packet with central 'connect to' timestamp to determine sniff start time.

'Delta' is Periph - Sniff in milliseconds (positive = Periph later than Sniff)

Run	Central Timestamp	Sniff Packet	Sniff Time	Sniff Timestamp	Periph Timestamp	Delta (ms)	Status
1	09:59:30.468	2957	9.202s	09:59:30.468	09:59:30.582	114.5
2	10:00:29.380	4481	68.073s	10:00:29.339	10:00:29.452	113.1
3	10:01:30.655	6425	129.373s	10:01:30.639	10:01:30.751	111.7
4	10:02:31.999	8356	190.724s	10:02:31.990	10:02:32.100	110.4
5	10:03:33.192	9906	252.108s	10:03:33.374	10:03:33.483	108.8
6	10:04:34.307	11430	313.403s	10:04:34.669	10:04:34.776	107.2
7	10:05:35.536	12945	374.447s	10:05:35.713	10:05:35.819	105.8
8	10:06:36.679	---	---	---	10:06:36.965	---	MISSING
9	10:07:37.851	15726	496.949s	10:07:38.215	10:07:38.318	102.9
10	10:08:38.994	17292	557.722s	10:08:38.987	10:08:39.089	101.5
11	10:09:40.114	18850	619.222s	10:09:40.488	10:09:40.588	100.0
12	10:10:41.323	---	---	---	10:10:41.604	---	MISSING
13	10:11:42.461	21588	741.570s	10:11:42.835	10:11:42.932	97.0
14	10:12:44.013	23135	802.753s	10:12:44.019	10:12:44.114	95.6
15	10:13:44.984	25052	863.909s	10:13:45.175	10:13:45.269	94.0
16	10:14:46.194	26967	925.116s	10:14:46.382	10:14:46.474	92.6
17	10:15:47.582	---	---	---	10:15:47.681	---	MISSING
18	10:16:48.660	---	---	---	10:16:48.923	---	MISSING
19	10:17:50.050	---	---	---	10:17:50.324	---	MISSING
20	10:18:51.304	31396	1170.228s	10:18:51.494	10:18:51.570	75.8

For those connections where the sniff trace is missing the CONNECT_IND packets, the sniffer is reporting:

No.	Time	Source	Destination	Protocol	Length	Info
14493	435.209332	00:18:80:ff:9e:b1	ff:ff:ff:ff:ff:ff	LE LL	60	ADV_IND
14494	435.209835	54:dd:91:ed:a4:0e	00:18:80:ff:9e:b1	LE LL	38	SCAN_REQ
14495	435.210161	00:18:80:ff:9e:b1	ff:ff:ff:ff:ff:ff	LE LL	57	SCAN_RSP
14496	435.400442	00:18:80:ff:9e:b1	ff:ff:ff:ff:ff:ff	LE LL	60	ADV_IND
14497	435.401525	00:18:80:ff:9e:b1	ff:ff:ff:ff:ff:ff	LE LL	60	ADV_IND
14498	435.402607	00:18:80:ff:9e:b1	ff:ff:ff:ff:ff:ff	LE LL	60	ADV_IND
14499	435.502148	Anonymous	ff:ff:ff:ff:ff:ff	LE LL	33	ADV_EXT_IND
14500	435.502489	Anonymous	ff:ff:ff:ff:ff:ff	LE LL	33	ADV_EXT_IND
14501	435.783063	Anonymous	ff:ff:ff:ff:ff:ff	LE LL	33	ADV_EXT_IND
.
.
.
14730	458.434650	Anonymous	ff:ff:ff:ff:ff:ff	LE LL	33	ADV_EXT_IND
14731	458.434991	Anonymous	ff:ff:ff:ff:ff:ff	LE LL	33	ADV_EXT_IND
14732	458.435332	Anonymous	ff:ff:ff:ff:ff:ff	LE LL	33	ADV_EXT_IND
14733	458.479574	00:18:80:ff:9e:b1	ff:ff:ff:ff:ff:ff	LE LL	60	ADV_IND
14734	458.480657	00:18:80:ff:9e:b1	ff:ff:ff:ff:ff:ff	LE LL	60	ADV_IND

The second thing I've learned about this issue is that it depends heavily on the behavior of the Samsung/Android tablet. I have ported everything (central, peripheral, central-with-extended-advertising) to nrf52840dongle targets and though I do see the occasional loss of sync as shown above, the sniffer never ends up stuck out of sync for extended periods.

One more thing - in addition to getting stuck capturing/reporting anonymous extended advertising packets despite on-going LL traffic, I have also seen the sniffer get completely wedged. In this state it doesn't forward anything to Wireshark and there are no LEDs illuminated on the nrf52840dongle. This may be another issue altogether but it seems related to me.

To help you recreate this issue I can upload a peripheral .zip (built for nrf52840dongle/nrf52840) and an android .apk for a central target - please confirm that you have the tools/hardware available to install and run the android target.

Just FYI, here is a depiction of the test setup for the test run described above:

And here is the complete summary of the connect events for the entire run:

Connect events:

Periph 'Connection opened': 200
Central 'connect to': 200
Sniff CONNECT_IND: 60

'Sniff Timestamp' is calculated by aligning the first CONNECT_IND packet with central entry 1 'connect to' timestamp to determine sniff start time.

'Delta' is Periph - Sniff in milliseconds (positive = Periph later than Sniff)

Run	Central Timestamp	Sniff Packet	Sniff Time	Sniff Timestamp	Periph Timestamp	Delta (ms)	Status
1	09:59:30.468	2957	9.202s	09:59:30.468	09:59:30.582	114.5
2	10:00:29.380	4481	68.073s	10:00:29.339	10:00:29.452	113.1
3	10:01:30.655	6425	129.373s	10:01:30.639	10:01:30.751	111.7
4	10:02:31.999	8356	190.724s	10:02:31.990	10:02:32.100	110.4
5	10:03:33.192	9906	252.108s	10:03:33.374	10:03:33.483	108.8
6	10:04:34.307	11430	313.403s	10:04:34.669	10:04:34.776	107.2
7	10:05:35.536	12945	374.447s	10:05:35.713	10:05:35.819	105.8
8	10:06:36.679	---	---	---	10:06:36.965	---	MISSING
9	10:07:37.851	15726	496.949s	10:07:38.215	10:07:38.318	102.9
10	10:08:38.994	17292	557.722s	10:08:38.987	10:08:39.089	101.5
11	10:09:40.114	18850	619.222s	10:09:40.488	10:09:40.588	100.0
12	10:10:41.323	---	---	---	10:10:41.604	---	MISSING
13	10:11:42.461	21588	741.570s	10:11:42.835	10:11:42.932	97.0
14	10:12:44.013	23135	802.753s	10:12:44.019	10:12:44.114	95.6
15	10:13:44.984	25052	863.909s	10:13:45.175	10:13:45.269	94.0
16	10:14:46.194	26967	925.116s	10:14:46.382	10:14:46.474	92.6
17	10:15:47.582	---	---	---	10:15:47.681	---	MISSING
18	10:16:48.660	---	---	---	10:16:48.923	---	MISSING
19	10:17:50.050	---	---	---	10:17:50.324	---	MISSING
20	10:18:51.304	31396	1170.228s	10:18:51.494	10:18:51.570	75.8
21	10:19:52.417	---	---	---	10:19:52.873	---	MISSING
22	10:20:53.734	34148	1292.666s	10:20:53.932	10:20:54.004	72.5
23	10:21:54.982	---	---	---	10:21:55.625	---	MISSING
24	10:22:56.394	36926	1415.326s	10:22:56.592	10:22:56.661	69.0
25	10:23:57.462	38496	1476.401s	10:23:57.666	10:23:57.734	67.4
26	10:24:58.515	40021	1537.444s	10:24:58.710	10:24:58.776	65.7
27	10:26:00.088	41953	1599.026s	10:26:00.291	10:26:00.355	63.8
28	10:27:01.208	42987	1659.943s	10:27:01.209	10:27:01.271	62.2
29	10:28:02.347	44182	1721.649s	10:28:02.915	10:28:02.975	60.5
30	10:29:03.659	---	---	---	10:29:03.734	---	MISSING
31	10:30:04.905	45820	1843.664s	10:30:04.929	10:30:04.986	57.1
32	10:31:06.043	46843	1904.982s	10:31:06.247	10:31:06.303	55.5
33	10:32:07.214	47639	1966.351s	10:32:07.616	10:32:07.670	53.7
34	10:33:08.552	48477	2027.324s	10:33:08.589	10:33:08.641	52.1
35	10:34:09.469	49814	2088.233s	10:34:09.498	10:34:09.549	50.4
36	10:35:10.523	50910	2149.651s	10:35:10.917	10:35:10.965	48.8
37	10:36:12.115	---	---	---	10:36:12.184	---	MISSING
38	10:37:13.359	52915	2272.111s	10:37:13.377	10:37:13.422	45.4
39	10:38:14.683	54387	2333.451s	10:38:14.716	10:38:14.760	43.8
40	10:39:15.934	---	---	---	10:39:16.016	---	MISSING
41	10:40:16.827	---	---	---	10:40:16.894	---	MISSING
42	10:41:18.095	56699	2516.857s	10:41:18.123	10:41:18.162	38.8
43	10:42:19.311	57304	2578.648s	10:42:19.913	10:42:19.951	37.2
44	10:43:20.198	---	---	---	10:43:20.442	---	MISSING
45	10:44:21.403	59204	2700.363s	10:44:21.629	10:44:21.663	34.1
46	10:45:22.630	60158	2761.409s	10:45:22.675	10:45:22.707	32.4
47	10:46:23.858	61360	2822.816s	10:46:24.081	10:46:24.112	30.6
48	10:47:25.566	62705	2884.344s	10:47:25.610	10:47:25.639	28.9
49	10:48:26.097	63646	2945.049s	10:48:26.314	10:48:26.342	27.4
50	10:49:27.313	64685	3006.277s	10:49:27.543	10:49:27.569	25.6
51	10:50:28.473	66146	3067.435s	10:50:28.701	10:50:28.725	24.0
52	10:51:29.743	67149	3128.517s	10:51:29.783	10:51:29.860	77.2
53	10:52:30.972	67959	3189.934s	10:52:31.199	10:52:31.276	77.0
54	10:53:32.147	68702	3250.921s	10:53:32.187	10:53:32.263	76.6
55	10:54:33.476	69779	3312.439s	10:54:33.705	10:54:33.781	76.2
56	10:55:34.522	70419	3373.308s	10:55:34.574	10:55:34.649	75.8
57	10:56:35.645	---	---	---	10:56:36.152	---	MISSING
58	10:57:36.971	72382	3495.948s	10:57:37.214	10:57:37.289	75.0
59	10:58:37.910	---	---	---	10:58:38.033	---	MISSING
60	10:59:38.814	---	---	---	10:59:38.905	---	MISSING
61	11:00:40.171	---	---	---	11:00:40.310	---	MISSING
62	11:01:41.503	75948	3740.296s	11:01:41.562	11:01:41.636	73.6
63	11:02:42.746	---	---	---	11:02:43.056	---	MISSING
64	11:03:43.924	77448	3862.903s	11:03:44.169	11:03:44.241	72.8
65	11:04:44.871	78899	3924.039s	11:04:45.305	11:04:45.377	72.5
66	11:05:46.198	79995	3984.990s	11:05:46.256	11:05:46.328	72.2
67	11:06:47.280	80648	4046.075s	11:06:47.340	11:06:47.412	71.7
68	11:07:48.537	81263	4107.515s	11:07:48.781	11:07:48.852	71.3
69	11:08:49.516	82391	4169.084s	11:08:50.349	11:08:50.420	71.0
70	11:09:50.661	83432	4229.644s	11:09:50.909	11:09:50.980	70.6
71	11:10:51.920	84412	4291.292s	11:10:52.558	11:10:52.628	70.3
72	11:11:53.304	85547	4352.068s	11:11:53.334	11:11:53.404	70.0
73	11:12:54.534	86253	4413.332s	11:12:54.597	11:12:54.667	69.5
74	11:13:55.681	86872	4474.672s	11:13:55.937	11:13:56.007	69.2
75	11:14:56.675	---	---	---	11:14:57.000	---	MISSING
76	11:15:57.844	88398	4596.648s	11:15:57.914	11:15:57.982	68.4
77	11:16:59.323	---	---	---	11:16:59.465	---	MISSING
78	11:18:00.385	---	---	---	11:18:00.701	---	MISSING
79	11:19:01.725	---	---	---	11:19:01.858	---	MISSING
80	11:20:02.667	---	---	---	11:20:03.180	---	MISSING
81	11:21:04.029	---	---	---	11:21:04.182	---	MISSING
82	11:22:05.340	---	---	---	11:22:05.481	---	MISSING
83	11:23:06.196	---	---	---	11:23:06.496	---	MISSING
84	11:24:07.533	---	---	---	11:24:07.680	---	MISSING
85	11:25:08.592	---	---	---	11:25:08.738	---	MISSING
86	11:26:09.411	---	---	---	11:26:09.710	---	MISSING
87	11:27:11.176	---	---	---	11:27:12.068	---	MISSING
88	11:28:12.347	---	---	---	11:28:12.648	---	MISSING
89	11:29:13.355	---	---	---	11:29:13.841	---	MISSING
90	11:30:14.771	---	---	---	11:30:14.885	---	MISSING
91	11:31:15.658	---	---	---	11:31:15.953	---	MISSING
92	11:32:17.118	---	---	---	11:32:17.608	---	MISSING
93	11:33:18.186	---	---	---	11:33:18.483	---	MISSING
94	11:34:19.258	---	---	---	11:34:19.743	---	MISSING
95	11:35:20.438	---	---	---	11:35:20.732	---	MISSING
96	11:36:21.670	---	---	---	11:36:21.785	---	MISSING
97	11:37:22.858	---	---	---	11:37:23.340	---	MISSING
98	11:38:24.109	---	---	---	11:38:25.362	---	MISSING
99	11:39:25.213	---	---	---	11:39:25.506	---	MISSING
100	11:40:26.325	---	---	---	11:40:26.627	---	MISSING
101	11:41:27.654	---	---	---	11:41:27.760	---	MISSING
102	11:42:28.920	---	---	---	11:42:29.217	---	MISSING
103	11:43:30.052	---	---	---	11:43:30.346	---	MISSING
104	11:44:31.030	---	---	---	11:44:31.525	---	MISSING
105	11:45:32.254	---	---	---	11:45:32.558	---	MISSING
106	11:46:33.497	---	---	---	11:46:33.981	---	MISSING
107	11:47:34.887	---	---	---	11:47:35.173	---	MISSING
108	11:48:36.220	---	---	---	11:48:36.701	---	MISSING
109	11:49:37.535	---	---	---	11:49:37.833	---	MISSING
110	11:50:38.530	---	---	---	11:50:39.026	---	MISSING
111	11:51:39.733	---	---	---	11:51:40.031	---	MISSING
112	11:52:41.268	---	---	---	11:52:41.382	---	MISSING
113	11:53:42.203	---	---	---	11:53:42.495	---	MISSING
114	11:54:43.376	---	---	---	11:54:43.666	---	MISSING
115	11:55:44.465	---	---	---	11:55:44.767	---	MISSING
116	11:56:45.603	---	---	---	11:56:46.077	---	MISSING
117	11:57:47.143	---	---	---	11:57:47.441	---	MISSING
118	11:58:48.806	---	---	---	11:58:48.915	---	MISSING
119	11:59:49.525	---	---	---	11:59:49.629	---	MISSING
120	12:00:50.638	---	---	---	12:00:50.957	---	MISSING
121	12:01:51.790	---	---	---	12:01:52.473	---	MISSING
122	12:02:53.792	---	---	---	12:02:54.098	---	MISSING
123	12:03:56.074	---	---	---	12:03:56.767	---	MISSING
124	12:04:57.022	---	---	---	12:04:57.522	---	MISSING
125	12:05:58.245	---	---	---	12:05:58.376	---	MISSING
126	12:06:59.145	---	---	---	12:06:59.653	---	MISSING
127	12:08:00.166	---	---	---	12:08:00.656	---	MISSING
128	12:09:01.883	---	---	---	12:09:02.983	---	MISSING
129	12:10:03.027	---	---	---	12:10:03.157	---	MISSING
130	12:11:04.210	---	---	---	12:11:04.527	---	MISSING
131	12:12:05.293	---	---	---	12:12:05.617	---	MISSING
132	12:13:06.205	---	---	---	12:13:06.339	---	MISSING
133	12:14:07.885	---	---	---	12:14:08.198	---	MISSING
134	12:15:08.979	---	---	---	12:15:09.292	---	MISSING
135	12:16:09.967	---	---	---	12:16:10.655	---	MISSING
136	12:17:11.205	---	---	---	12:17:11.525	---	MISSING
137	12:18:12.058	---	---	---	12:18:12.569	---	MISSING
138	12:19:13.726	---	---	---	12:19:13.858	---	MISSING
139	12:20:14.810	---	---	---	12:20:15.324	---	MISSING
140	12:21:15.832	---	---	---	12:21:16.150	---	MISSING
141	12:22:17.058	---	---	---	12:22:17.379	---	MISSING
142	12:23:18.355	---	---	---	12:23:18.682	---	MISSING
143	12:24:19.356	---	---	---	12:24:19.488	---	MISSING
144	12:25:20.611	---	---	---	12:25:20.934	---	MISSING
145	12:26:21.823	---	---	---	12:26:22.148	---	MISSING
146	12:27:23.033	---	---	---	12:27:23.177	---	MISSING
147	12:28:24.180	---	---	---	12:28:24.306	---	MISSING
148	12:29:25.763	---	---	---	12:29:26.273	---	MISSING
149	12:30:26.893	---	---	---	12:30:27.192	---	MISSING
150	12:31:28.101	---	---	---	12:31:28.772	---	MISSING
151	12:32:29.248	---	---	---	12:32:29.348	---	MISSING
152	12:33:30.836	---	---	---	12:33:31.330	---	MISSING
153	12:34:32.387	---	---	---	12:34:32.865	---	MISSING
154	12:35:33.778	---	---	---	12:35:34.064	---	MISSING
155	12:36:34.878	---	---	---	12:36:35.158	---	MISSING
156	12:37:35.967	---	---	---	12:37:36.434	---	MISSING
157	12:38:37.378	---	---	---	12:38:37.476	---	MISSING
158	12:39:38.552	---	---	---	12:39:38.651	---	MISSING
159	12:40:39.664	---	---	---	12:40:40.133	---	MISSING
160	12:41:41.013	---	---	---	12:41:41.487	---	MISSING
161	12:42:42.295	---	---	---	12:42:42.580	---	MISSING
162	12:43:43.289	---	---	---	12:43:43.932	---	MISSING
163	12:44:44.723	---	---	---	12:44:44.812	---	MISSING
164	12:45:45.953	---	---	---	12:45:46.408	---	MISSING
165	12:46:46.867	---	---	---	12:46:47.140	---	MISSING
166	12:47:48.128	---	---	---	12:47:48.595	---	MISSING
167	12:48:49.536	---	---	---	12:48:50.016	---	MISSING
168	12:49:50.566	---	---	---	12:49:51.033	---	MISSING
169	12:50:51.710	---	---	---	12:50:51.988	---	MISSING
170	12:51:52.880	---	---	---	12:51:53.165	---	MISSING
171	12:52:53.866	---	---	---	12:52:53.955	---	MISSING
172	12:53:55.154	---	---	---	12:53:55.246	---	MISSING
173	12:54:56.811	---	---	---	12:54:57.090	---	MISSING
174	12:55:57.824	---	---	---	12:55:58.070	---	MISSING
175	12:56:59.256	---	---	---	12:57:00.122	---	MISSING
176	12:58:00.190	---	---	---	12:58:00.646	---	MISSING
177	12:59:01.447	---	---	---	12:59:02.877	---	MISSING
178	13:00:02.940	152047	10842.034s	13:00:03.300	13:00:03.214	-86.7
179	13:01:04.330	152848	10903.427s	13:01:04.693	13:01:04.605	-88.1
180	13:02:05.469	---	---	---	13:02:05.748	---	MISSING
181	13:03:06.645	---	---	---	13:03:07.279	---	MISSING
182	13:04:08.090	---	---	---	13:04:08.400	---	MISSING
183	13:05:09.156	---	---	---	13:05:09.478	---	MISSING
184	13:06:10.504	---	---	---	13:06:10.807	---	MISSING
185	13:07:11.796	---	---	---	13:07:12.117	---	MISSING
186	13:08:13.043	---	---	---	13:08:13.369	---	MISSING
187	13:09:15.004	---	---	---	13:09:15.328	---	MISSING
188	13:10:16.344	---	---	---	13:10:16.473	---	MISSING
189	13:11:17.543	---	---	---	13:11:17.676	---	MISSING
190	13:12:19.117	---	---	---	13:12:20.034	---	MISSING
191	13:13:20.051	---	---	---	13:13:20.943	---	MISSING
192	13:14:21.077	---	---	---	13:14:21.408	---	MISSING
193	13:15:23.289	---	---	---	13:15:23.787	---	MISSING
194	13:16:24.424	---	---	---	13:16:25.105	---	MISSING
195	13:17:25.626	---	---	---	13:17:25.757	---	MISSING
196	13:18:26.874	---	---	---	13:18:27.379	---	MISSING
197	13:19:27.971	---	---	---	13:19:28.655	---	MISSING
198	13:20:29.110	---	---	---	13:20:29.428	---	MISSING
199	13:21:30.229	---	---	---	13:21:30.739	---	MISSING
200	13:22:31.259	---	---	---	13:22:31.957	---	MISSING

RE: Anonymous advertising packets in long nRF52840 BLE sniffer sessions cause device/MAC address filtering to fail

kp88 — Mon, 09 Feb 2026 19:34:08 GMT

Hi, thank you for the reply!

Yes, stopping and starting Wireshark capture and resetting the device/MAC address capture filter will restore functionality for a while but it eventually ends up in the same state. And yes, in this state all packets from normal peripheral advertising and host-peripheral connections are missing.

Would a full .pcapng log be helpful?

As for reproducing the issue, it is currently tied up in my test environment running a Samsung/Android host against an ADI/MAX32666FTHR peripheral, so not super easy to recreate. The basic structure consists of running 100s of repeats of 20s connections between the host and peripheral where each connection consists of periodic (1 second) notifications from the peripheral. I have confirmed that the anonymous extended advertising packets are coming from the Samsung/Android host but I don't understand which application/service is sending them. My guess is something related to Android's mechanism for device discovery.

I could work to pair down the test env to something simpler if that would be helpful, e.g. using nRF52840 dongles all the way around, but that will take a little time.

RE: Anonymous advertising packets in long nRF52840 BLE sniffer sessions cause device/MAC address filtering to fail

tesc — Mon, 09 Feb 2026 14:39:01 GMT

Hi,

Based on the limited number of log lines that you provided, it does look like the rate of "Anonymous" transmissions stays the same, but after a couple of hours all other transmissions are missing from the sniffer trace? Will they reappear if you restart the sniffing, and what would be the steps to reproduce the issue?

Regards,
Terje