Wireshark BLE L2CAP packet reassembly

[cgreen]

I have some BLE traffic that I have sniffed and am displaying in Wireshark. Most of the opcodes (read/write request/response indications/notifications etc.) are parsed/displayed correctly. However, I have some packets that are prepare write requests/responses and these just show as L2CAP fragments. Is there a way to reassemble fragmented prepare write requests/responses in Wireshark so that I can see the header data (attribute opcodes 0x16, 0x17) and reassembled value?

[Stig]

The latest development version of Wireshark has support for BLE L2CAP reassembly, and even the Nordic BLE sniffer meta header (so you don't need the plugin).

You can try one of the latest automated builds from www.wireshark.org/.../

[David Edwin]

That is good if it works. This other question would be related to getting the latest wirehshark to work properly. devzone.nordicsemi.com/.../

Can you try it and let us know if this works for you ?

[Stig]

As a temporary workaround (until nRFSniffer is updated) it's possible to capture with Wireshark 1.10.x and then save the capture file to be used in Wireshark 2.x.x to use the updated BLE dissectors.