How do I filter empty pdu in wireshark?

[Mitch996]

Hi, I'm new to wireshark, and I want to filter all those empty pdus, they make it really hard for me to find the useful packets.

I tried btle.lendgth != 0, but got an error message telling me that neither length nor 0 are fields or protocol names.

Is there any other way to do this? I tried googling but with no luck.

[Sigurd]

Hi,

In your post are using lendgth instead of length. If it's not working with btle.length != 0, it could be because the correct plugins are not installed.

Note that you have to install the Wireshark plugins that comes with the nRF-Sniffer.

Run the Plugins.exe installer. If it's still not working, see the Troubleshooting chapter in the nRF-Sniffer User guide. I.e:

Wireshark does not recognize btle or nordic_ble, and the Sniffer program cannot find version information for the plugins.

Run the Sniffer as Administrator. This should install the plugin automatically.

If you are running the Sniffer program manually:

1. Copy btle.dll and nordic_ble.dll from the Sniffer directory to \plugins<version>.

2. Use the files in ...\plugins[Wireshark major version]\windows\x64 if your Wireshark version is 64 bit, or the files in ...plugins[Wireshark major version]\windows\x86 if Wireshark is 32 bit.

[Mitch996]

Hi, tried running with the admin privileges, didn't work. The user guid isn't helpful.

Also when inputing filter, there should be a hint. btle is properlly recodnized, so are other fields, but there isn't a field called btle.length...

[Sigurd]

If you open up the "Expression" filter, do you have BTLE there?: