• State Not Answered
  • Replies 10 replies
  • Subscribers 62 subscribers
  • Views 6981 views
  • Users 0 members are here
Attachments (0)
Nordic Case Info
  • Case ID: 114626
Options
This post is older than 2 years and might not be relevant anymore
More Info: Consider searching for newer posts

Wireshark BLE L2CAP packet reassembly

cgreen

I have some BLE traffic that I have sniffed and am displaying in Wireshark. Most of the opcodes (read/write request/response indications/notifications etc.) are parsed/displayed correctly. However, I have some packets that are prepare write requests/responses and these just show as L2CAP fragments. Is there a way to reassemble fragmented prepare write requests/responses in Wireshark so that I can see the header data (attribute opcodes 0x16, 0x17) and reassembled value?

Parents
  • 0

    Nope. There's no code in wireshark which does that for BLE. In fact there's not much stateful conversation parsing in the BLE dissectors at all.

    You could add code to do that and submit it to wireshark, but you probably want to check it's not already on someone's radar and if it's the kind of stateful dissection they'd want.

Reply
  • 0

    Nope. There's no code in wireshark which does that for BLE. In fact there's not much stateful conversation parsing in the BLE dissectors at all.

    You could add code to do that and submit it to wireshark, but you probably want to check it's not already on someone's radar and if it's the kind of stateful dissection they'd want.

Children
No Data
Related