I'm trying to capture a ble connection with nrfutil.
What I've done:
- installed nrfutil on my arch based linux machine
- install ble-sniffer
- setup the nRF52840 Dongle with the given firmware.
- the device itself (usb, tty, etc) works
I can start sniffing the advertising paket with
nrfutil ble-sniffer sniff --port /dev/ttyACM1 --log-level=info --log-output=stdout --json
It works fine an gives several devices like this:
{"type":"log","data":{"level":"INFO","message":"Device added: {\"address\":{\"address\":\"f8:55:48:13:9c:a9\",\"type\":\"Public\"},\"name\":{\"name\":\"DEMO9CA9\",\"ty\":\"ShortenedLocalName\"},\"rssi\":-57,\"is_followed\":false}","timestamp":"2026-04-21T10:11:38.484Z"}}
But if I try to follow the device of interest I got the following output:
$nrfutil ble-sniffer sniff --port /dev/ttyACM1 --follow f8:55:48:13:9c:a9 --log-level=info --log-output=stdout --json
{"type":"log","data":{"level":"INFO","message":"nrfutil-ble-sniffer (version = 0.18.0, platform = x86_64-unknown-linux-gnu, classification = nrf-external) invoked with sniff --port /dev/ttyACM1 --follow f8:55:48:13:9c:a9 --log-level=info --log-output=stdout --json ","timestamp":"2026-04-21T10:12:39.446Z"}}
{"type":"log","data":{"level":"INFO","message":"Attempt opening serial port at /dev/ttyACM1","timestamp":"2026-04-21T10:12:39.447Z"}}
{"type":"log","data":{"level":"INFO","message":"Subscribing to event DEVICE_ADDED","timestamp":"2026-04-21T10:12:39.448Z"}}
{"type":"log","data":{"level":"INFO","message":"Sending version request","timestamp":"2026-04-21T10:12:39.448Z"}}
{"type":"log","data":{"level":"INFO","message":"Sending ping request","timestamp":"2026-04-21T10:12:39.448Z"}}
{"type":"log","data":{"level":"INFO","message":"Sending timestamp request","timestamp":"2026-04-21T10:12:39.448Z"}}
{"type":"log","data":{"level":"INFO","message":"Sending advertisement hop sequence request for channels [37, 38, 39]","timestamp":"2026-04-21T10:12:39.451Z"}}
{"type":"log","data":{"level":"INFO","message":"Changing state from IDLE to SCANNING","timestamp":"2026-04-21T10:12:39.452Z"}}
{"type":"log","data":{"level":"INFO","message":"Sending scan packet","timestamp":"2026-04-21T10:12:39.452Z"}}
{"type":"log","data":{"level":"INFO","message":"Sending request to use temporary key [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]","timestamp":"2026-04-21T10:12:39.453Z"}}
{"type":"log","data":{"level":"INFO","message":"Changing state from SCANNING to FOLLOWING","timestamp":"2026-04-21T10:12:39.454Z"}}
{"type":"log","data":{"level":"WARN","message":"No device with address f8:55:48:13:9c:a9 random found. Still sending the follow request call, but no device is registered as followed.","timestamp":"2026-04-21T10:12:39.454Z"}}
{"type":"log","data":{"level":"INFO","message":"Sending follow request to follow device with address f8:55:48:13:9c:a9 random","timestamp":"2026-04-21T10:12:39.454Z"}}
In the resulting pcap file there are only advertising pakets.
There is the warning ""WARN","message":"No device with address f8:55:48:13:9c:a9 ... The ble-sniffer doesn't scan and add the device before it starts following.
Whats wrong here?
