BLE 4.2 sniffer

RE: BLE 4.2 sniffer

jeffs — Wed, 28 Mar 2018 23:20:08 GMT

Just to keep terms correct, I think you may be looking for a larger PDU. A larger GATT MTU can be supported with 4.0/4.1.

RE: BLE 4.2 sniffer

Torsten Robitzki — Thu, 22 Mar 2018 10:59:37 GMT

Are you sure, that it can capture and display larger MTU size traffic?

RE: BLE 4.2 sniffer

viewtool — Tue, 19 Dec 2017 09:12:09 GMT

Try Hollong Viewtool sniffer: www.amazon.com/.../ref=sr_1_fkmr0_2

Just $99!!!Support BLE4.0/4.1/4.2 protocol analysis and interpret

RE: BLE 4.2 sniffer

Torsten Robitzki — Mon, 04 Sep 2017 11:38:31 GMT

Works like a charm for me. Sorry for the late feedback!

RE: BLE 4.2 sniffer

Phil Beeson — Wed, 16 Aug 2017 10:53:20 GMT

At the moment I'd settle for support for 4.2 Data Length Extensions. Longer term I'd want to see support for all the 5.0 features endnode asks for. Put simply, if you add a feature to the SD, then I want to be able to see the OTA data with the sniffer so that if something is going wrong, I have a chance of understanding it. It is encouraging to hear that there is an internal push to make this happen. We'll all thank you for it when it does!

RE: BLE 4.2 sniffer

David Edwin — Wed, 09 Aug 2017 12:14:18 GMT

As answered by Hung the answer remains "no to 4.2 support at this point" but we are trying hard to make that a yes. I understand and share your frustration. We are now staffed up for Wireshark support and continue to push internally to get the firmware upgrades in place.

RE: BLE 4.2 sniffer

endnode — Wed, 09 Aug 2017 11:57:02 GMT

Well ideally Nordic sniffer should be able to follow connection of two Nordic nRF52840 PDKs using whatever config you have in throughput demo (PDU extension, ATT MTU extension, connection interval extension, long range and 2MBps air speeds, extended broadcasting once it is supported by your stack etc.) I totally understand that it's extensive work and that some features might be easier to do then others. I guess it's more strategic decision if Nordic invests to nRF sniffer at all (because correct me if I'm wrong but there was really minimal effort put into it in last 3 years, it hardly changed since 2014). It's unbelievably useful tool for all BLE developers on the budget today and as more and more will migrate to new 4.2/5.0 features it has potential to be either forgotten in few years or conquer this space;) It's up to you guys.

RE: BLE 4.2 sniffer

David Edwin — Wed, 09 Aug 2017 11:50:34 GMT

We do have support for Wireshark 2.4.x at this point with one manual change needed to attach the DLT 157 to "nordic_ble". Yes, 4.2 is a gap.

Can you comment on which 4.2 features that you are looking at ? some are fairly easy to address but others are a bit harder.

RE: BLE 4.2 sniffer

RK — Tue, 08 Aug 2017 21:11:24 GMT

My recollection is it puts a handy header in yellow telling you DLT157 isn't registered and helpfully suggesting you go to Preferences->Protocols->DLT_USER. Which the guy in this thread followed, worked out the only hard bit, that the decoder is called 'nordic_ble' and .. due to wireshark integrating the decoder 2 years ago, it works. And you all the new BLE stuff, and a ton of bug fixes.

he also gives some handy tips in there for capturing from a pipe which won't work because the OSX pipes aren't in the same place, I believe it's on-screen somewhere in the app and you could probably set it up for a live capture, but I can't imagine it's fun.

RE: BLE 4.2 sniffer

Torsten Robitzki — Tue, 08 Aug 2017 14:31:04 GMT

Well I tried it and it just shows raw byte packages. Is wireshark going to decode the BLE PDUs on it's own, or is the wireshark dissector from the nordic sniffer required?

RE: BLE 4.2 sniffer

RK — Tue, 08 Aug 2017 13:39:52 GMT

no - where did you get that idea from - I use the latest and greatest and it has much better BTLE decoding. The wire format hasn't changed.

Perhaps you should try some things out, you seem hamstrung by things you think you can't do.

RE: BLE 4.2 sniffer

Torsten Robitzki — Tue, 08 Aug 2017 12:37:43 GMT

But then, I still need the old version of wire shark to analyse it?

RE: BLE 4.2 sniffer

RK — Tue, 08 Aug 2017 12:06:32 GMT

it's on the Capture menu - there's a save button - that brings up a dialog which asks you where you want it saved.

RE: BLE 4.2 sniffer

Torsten Robitzki — Tue, 08 Aug 2017 12:04:50 GMT

Well, I thought the project isn't alive anymore. With sourceforge, it seems that even the password recovery process isn't working anymore.

I find the capture to wireshark the most usefull option. I tried to use the capture to PCAP option, but I have to clue, where the resulting output should be found.

RE: BLE 4.2 sniffer

RK — Tue, 08 Aug 2017 11:53:30 GMT

yeah - is there a bug report I missed? I've not seen anyone post a question for a year I think. Given that Nordic continues to recommend an older version of wireshark I had no idea anyone was using a newer one. I tend to dump the stuff to pcap files with the code and then look at it in wireshark afterwards anyway, never really found the 'live view' that useful (and it got broken by one of the wireshark updates a couple of years back but I think that's long fixed by now).

RE: BLE 4.2 sniffer

Torsten Robitzki — Tue, 08 Aug 2017 11:51:12 GMT

@RK Are you talking about ble-sniffer-osx?

RE: BLE 4.2 sniffer

Torsten Robitzki — Tue, 08 Aug 2017 11:50:02 GMT

@RK Thanks I didn't saw that on the first spot.

RE: BLE 4.2 sniffer

RK — Tue, 08 Aug 2017 11:49:40 GMT

ps if you wanted it to work with a more recent version of wireshark, did you think of perhaps putting a comment or filing a bug on the project. If people don't ask, I sort of tend to assume they don't need.

RE: BLE 4.2 sniffer

RK — Tue, 08 Aug 2017 11:46:41 GMT

OK at some point I'll upgrade to the latest wireshark for it, I thought I was at least fairly current .. actually it's easier now as all the drivers are built in.

And I don't need to share the protocol documentation, nordic provides it in the package you download, they made that available about .. well 3 years ago. You just have to read it.

RE: BLE 4.2 sniffer

Torsten Robitzki — Tue, 08 Aug 2017 11:43:11 GMT

@RK Well, if you are talking about ble-sniffer-osx, I'm using that. But unfortunately, this isn't working with recent versions of wire share. Do you have protocol documentations, that you can share with us. Starting with a UART <-> Wireshark adapter, using the existing eval board firmware could speedup development.

RE: BLE 4.2 sniffer

endnode — Tue, 08 Aug 2017 11:41:31 GMT

I'm afraid you are right but anyway I would very much recommend Nordic to invest to their Sniffer, it could be again great tool on nRF52 or nRF52840 DK and marketing impact on the community (= people who are not using nRF chips yet but would use Sniffer and potentially migrate to Nordic HW completely) could easily bring the investment back... but probably just my view.

RE: BLE 4.2 sniffer

RK — Tue, 08 Aug 2017 11:37:45 GMT

I did the OSX port of the receiving software 3-4 years ago. That's been available ever since, I still use it. I don't think Nordic has any plans to rewrite the sniffer software itself, so you're never going to get the kind of BTLE5 information you want that way.

RE: BLE 4.2 sniffer

Torsten Robitzki — Tue, 08 Aug 2017 11:32:39 GMT

I'm in the very same situation. I have MTU sizes > 200 bytes and I'm blind to what happens over the air. In addition, I have the problem, that I'm using a Mac to work with. If I got the NRF Sniffer architecture right: There is a firmware on an evaluation board, sending the received data via a serial connection, which is then reformated by some python scripts, which send sends the data to wireshark for interpretation.

I would be happy to help to port the windows-only part to OS/X and to help to improve the eval board firmware, if Nordic want's to release this as open source.

I mean, yes, I could write a firmware for an eval board that does the same and write an adapter for wireshark, but this would likely take me some weeks and the NRF Sniffer is already there.

RE: BLE 4.2 sniffer

endnode — Tue, 25 Jul 2017 14:50:26 GMT

I do agree Phil, missing radio sniffer FW support with BT LE 4.2 and 5 features is probably one of the biggest lack in Nordic support portfolio today. Hopefully they will invest into this again (soon).

RE: BLE 4.2 sniffer

Phil Beeson — Tue, 25 Jul 2017 14:47:22 GMT

It's a real shame Nordic haven't updated their sniffer for nRF52, trying to work with BLE 4.2 data length extensions, or even recent versions of Wireshark just isn't supported. It's just frustrating as they are normally really good at supporting developers, but I feel they've really dropped the ball on this.

However, I've been searching for a solution that doesn't cost the same as a small car and came across the USB-KW41Z from NXP. NXP support tell me that it will sniff BLE4.2 with long packets (community.nxp.com/.../453948) complete with wireshark screen capture. It's a relatively cheap device at around £70.

However, It's only fair to say, that so far I can't even follow BLE 4.1 unencrypted connections with it. Other people seem to be having some success (see NXP screenshot) but I'm not, so I can't wholeheartedly recommend it, but if you feel lucky, it might be worth a try.

Sorry Nordic, I wouldn't normally highlight competitor's offerings, but while you were developing the glowing thingy on my desk in front of me, others were developing tools that people in the devloper zone are actually asking for.