This post is older than 2 years and might not be relevant anymore
More Info: Consider searching for newer posts
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

nRF Sniffer support for Wireshark v2.0.3

Hi,

My setup:

  • Host: Windows 10, 64 bit
  • CPU: x86_64
  • Wireshark: v2.0.3 nRF
  • sniffer: v1.0.0
  • nRF Dongle: Segger, PCA100000, v2.2.0 (nRF51822QFAA based board)

Followed the Sniffer guide to successfully flash the dongle and start the sniffer application, however packet capturing is not working. Wireshark crashes and I see the message logged on the console that wireshark v2.0.3 is not supported. Is there a plan to add support for latest version of wireshark (v2.0.3) ?

Parents
  • Hello I'm a bit late but please find here my question for the same problem

    Latest update from wireshark is that they have integrated support for the sniffer. Wireshark bug12103 I tried it but doens't work for the moment. I hope the best and will keep you updated.

    If this integration works correctly, the update of nrfSniffer would be easy (no more dll to copy for wireshark v2.0.?6+?) and direct support.

    EDIT

    Hello,

    Wireshark support for version 2.0.x is definitelly in progress. The latest devloppement build here already support the nordic_BLE metadata. The pluggin dissector that was needed for versions 1.10.x has been fully integrated into wireshark sources and is not needed anymore. This means any Wireshark version above 2.3.0 (at the day of this post we are at 2.1.1 only) will nativelly support nordic_ble metadata.

    For the "simple user" with NRFsniffer1.0.1 here is a basic help on how to use wireshark 2.3.0 or more (note it will be simplified if Nordic does an update of it's nRFsniffer):

    • open the sniffer
    • open wireshark
    • go to capture->options->manage interfaces...->pipes
    • add \\.\pipe\wireshark_nordic_ble in the field
    • press OK and start the capture on this interface (for me I have to press several times for it to work)

    For the first time only you open Wireshark:

    • go to edit->preferences->protocols->DLT_USER
    • edit the encapsulation table and add "user10 (DLT=157)" with "nordic_ble" in payload protocol field.

    Message for Nordic people: Please do an update to nRFsniffer so that the tool does not copy the dll anymore for Wireshark versions 2.3.0 and above. This is a realy easy update but will help a lot for long term support of BLE.

    Thank you to Wireshark people that have integrated the plugin and for theyr great job on this tool.

    info sources

    EDIT 2 : July 2017##

    Wireshark 2.4.0 has better support it just require one manual configuration the first time you use it. (I think you shouldn't go with a version as old a 1.10.x)

    For the "simple user" with NRFsniffer1.0.1 here is a basic help on how to use wireshark 2.4.0 or more (note it could be simplified if Nordic does an update of it's nRFsniffer):

    • open the sniffer
    • press w as explained in docuementation

    For the first time only you open Wireshark:

    • go to edit->preferences->protocols->DLT_USER
    • edit the encapsulation table and add "user10 (DLT=157)" with "nordic_ble" in payload protocol field.
Reply
  • Hello I'm a bit late but please find here my question for the same problem

    Latest update from wireshark is that they have integrated support for the sniffer. Wireshark bug12103 I tried it but doens't work for the moment. I hope the best and will keep you updated.

    If this integration works correctly, the update of nrfSniffer would be easy (no more dll to copy for wireshark v2.0.?6+?) and direct support.

    EDIT

    Hello,

    Wireshark support for version 2.0.x is definitelly in progress. The latest devloppement build here already support the nordic_BLE metadata. The pluggin dissector that was needed for versions 1.10.x has been fully integrated into wireshark sources and is not needed anymore. This means any Wireshark version above 2.3.0 (at the day of this post we are at 2.1.1 only) will nativelly support nordic_ble metadata.

    For the "simple user" with NRFsniffer1.0.1 here is a basic help on how to use wireshark 2.3.0 or more (note it will be simplified if Nordic does an update of it's nRFsniffer):

    • open the sniffer
    • open wireshark
    • go to capture->options->manage interfaces...->pipes
    • add \\.\pipe\wireshark_nordic_ble in the field
    • press OK and start the capture on this interface (for me I have to press several times for it to work)

    For the first time only you open Wireshark:

    • go to edit->preferences->protocols->DLT_USER
    • edit the encapsulation table and add "user10 (DLT=157)" with "nordic_ble" in payload protocol field.

    Message for Nordic people: Please do an update to nRFsniffer so that the tool does not copy the dll anymore for Wireshark versions 2.3.0 and above. This is a realy easy update but will help a lot for long term support of BLE.

    Thank you to Wireshark people that have integrated the plugin and for theyr great job on this tool.

    info sources

    EDIT 2 : July 2017##

    Wireshark 2.4.0 has better support it just require one manual configuration the first time you use it. (I think you shouldn't go with a version as old a 1.10.x)

    For the "simple user" with NRFsniffer1.0.1 here is a basic help on how to use wireshark 2.4.0 or more (note it could be simplified if Nordic does an update of it's nRFsniffer):

    • open the sniffer
    • press w as explained in docuementation

    For the first time only you open Wireshark:

    • go to edit->preferences->protocols->DLT_USER
    • edit the encapsulation table and add "user10 (DLT=157)" with "nordic_ble" in payload protocol field.
Children
  • Wireshark v2.x is not supported at this point. You get best results only on the 1.10.x only. No support for 1.12.x or higher.

  • Hello David, Yes I confirm : support ONLY for 1.10.x. But I hope this will change quite fast ! (I will keep you updated)

  • I tried this with the latest wireshark build and it always says file not found when trying to start capture on that pipe. I listed the named pipes and it doesn't seem it was created. When I press "w" in the sniffer it just says "Starting Wireshark" and never proceeds, which makes me think it's not getting far enough to create the pipe even though Wireshark.exe is in my PATH. Any ideas on how to get the sniffer to proceed to create the pipe? Thanks

  • @Eric I do not have a dongle now and may try only next week. You used latest automated build and not v2.2.0 this should be OK. Not sure NRF sniffer uses the PATH (I supposed it uses the registry base to get last installed version path). Do not use "w" to start Wireshark, do it manually (but I will confirm this point). You may have a try with v 1.10.x (as "recommended" by Nordic) to see if the sniffer is able to create the pipe. If this doesn't work too, the sniffer may be the problem

  • @Julien I did use the latest automated build. Before that the sniffer was opening wireshark 2.2 with the pipe on its own just fine but it lacked the analyzer so the frames were junk. Does NRF create the pipe immediately? I didn't see it in technet.microsoft.com/.../dd581625.aspx Maybe I can just cat the pipe to a file somehow.

Related