Sniffing BLE LESC traffic in tshark.

RE: Sniffing BLE LESC traffic in tshark.

Hung Bui — Fri, 24 Jul 2026 14:19:49 GMT

Hi Umer,

To be honest I haven't used LESC debug keys with Wireshark and nRF sniffer. I usually just use the LTK printed out by CONFIG_BT_LOG_SNIFFER_INFO=y. I'm not so sure our sniffer can auto detect debug key or not.

RE: Sniffing BLE LESC traffic in tshark.

Umer — Thu, 23 Jul 2026 13:40:24 GMT

Hi Hung,

Initially it didn't worked at all. it started decrypting after a few day I enabled it. At first, I didn't even realized that it is due to debug keys, which is why I asked about vulnerability.
Now there is no pattern sometimes it starts decrypting and continue to decrypt for several sessions but then suddenly it stops decrypting again.

If you are asking about adding the LTK before recording, I have never face such issue while decrypting with LTK.

RE: Sniffing BLE LESC traffic in tshark.

Hung Bui — Thu, 23 Jul 2026 13:33:22 GMT

Hi Umer,

How often do you see that wireshark can't decrypt ? If you add the key every time before recording do you see the problem ?

RE: Sniffing BLE LESC traffic in tshark.

Umer — Wed, 22 Jul 2026 08:22:37 GMT

I understand debug keys are the most probable reason. However, the problem is debug keys should work for every session. Why is it not consistant?

RE: Sniffing BLE LESC traffic in tshark.

Hung Bui — Wed, 22 Jul 2026 08:11:54 GMT

Hi Umer,
I suspect that Wireshark may have the debug key stored. And reuse it after reboot.
But I don't see this as a big issue if it's the debug key that you use. Why you think it's a vulnerability in BT LESC if you use the debug key ?

RE: Sniffing BLE LESC traffic in tshark.

Umer — Tue, 21 Jul 2026 12:52:24 GMT

1. It sniffed the session on Wireshark, Initially it was not decrypting at all, there were only packets with bad MIC after the ENC_START packets. now, it sometimes decrypt and other times it don't. If you could tell me what exactly you want to check in the trace i will share it.

2. I am using using debug keys when bonding.

3. It is BT LESC.

RE: Sniffing BLE LESC traffic in tshark.

Hung Bui — Tue, 21 Jul 2026 12:40:25 GMT

Hi Umer,

Could you send the trace where it decrypted the bonding ?
Do you use the debug key when bonding or it's the normal default key generation ?

Was it LESC or it's Legacy pairing ?

RE: Sniffing BLE LESC traffic in tshark.

Umer — Mon, 13 Jul 2026 08:57:43 GMT

Hi Hung,

nrfutil actually worked perfectly for this case. It is able to filter the traffic with the device address and decrypt it with LTK with particular commands.
However, I have another concern now. I tried the debug key method before, but it was not working. I kept that mode enabled anyway. Recently, when I was testing again, Wireshark decrypted the whole bonding session without any key provided. I think this is because the debug mode is enabled, but the problem is it is not happening every time, so I can not certainly say it is due to debug keys.
1. What could be the reason that it is not happening every time?
2. Would it make any difference if I enable the debug mode on both devices?
3. Could there be any other possibilities why the scan was decrypted, such as any vulnerability in BT LESC? Because this happens only a few times, and I have tested so many times after enabling the debug keys.

RE: Sniffing BLE LESC traffic in tshark.

Hung Bui — Thu, 02 Jul 2026 13:21:23 GMT

Hi Umer,
I'm afraid that it's not very well documented. The sniffer created as a tool to assist debugging not a development tool.

We haven't got much development to the sniffer firmware in the last few years. So the situation remains the same.

I noticed another customer has managed to use tshark with the nrfsniffer. I haven't looked deep into this but maybe you can check ? https://www.adam-thomas.co.uk/blog/nrfutil-bluetooth-sniffer-with-tshark/

[quote user="Umer"] Also, I would like to know if I go with another appraoch like to use snifferAPI or nrfutil for automation purpose what would be the best appraoch? [/quote]

The functionality exposed to nrfutil is quite limited. It's made to be used with wireshark so I don't think you will be able to get much out of it. You will need to use the snifferAPI. But please check with the article above.

RE: Sniffing BLE LESC traffic in tshark.

Umer — Wed, 01 Jul 2026 15:20:05 GMT

Hi Hung,

Can you provide link to any document where I can find how exactly nRF use the LTK and if it can be used in middle of a session?

Decrypting a bonded session is easier, but I want to decrypt a bonding session for a specific purpose.

The problem with tshark is, it is not even filtering the traffic with device MAC address. I have read in some old Nordic cases that tshark is not supported with nRF sniffer. It seems like this still is the case here. can you confirm from any documentation? Also, I would like to know if I go with another appraoch like to use snifferAPI or nrfutil for automation purpose what would be the best appraoch?

RE: Sniffing BLE LESC traffic in tshark.

Hung Bui — Wed, 01 Jul 2026 11:46:10 GMT

Hi Umer,

1. The way I understood about how the sniffer works with the keys is that they LTK has to be provided to the sniffer firmware running on the nRF5x chip. The chip decript the packets on the fly and send it to PC/wireshark. So it's not wireshark or Tshark that decrypt the encrypted messages.

I'm not so sure if you can feed the LTK right before the encryption start to enable the sniffer to start decrypting the message. But you can try.

An easier way in my opinion is to do bonding, then disconnect, provide the LTK to the sniffer and then connect again. This way the sniffer will be able to use the LTK to decrypt the connection.

2. I don't have much experience with tshark. But as I mentioned the decrypting should be on the nRF52 not on the PC. So if you can capture unencrypted packet with tshark + nRF52 you should be able to do so with encrypted packets.