RE: nRF51 --> wireshark , absolute time (as in not a date in 1970 but 2018-04-15-ish :) )

David Edwin — Mon, 16 Apr 2018 12:29:09 GMT

Timeline in the sniffer is relative and it has 2 points that are usable and 1 that is not.

1. The timestamp that wireshark places is the PC timestamp when the packet is received in Wireshark.

2. The timestamp that is included in the packet i.e. delta time end to start is being measured in the firmware and is the delta from the end of one packet to the start of the next. This can be used to build the timeline in combination with the lengths of the sniffed packets. You must take care to account for packet overhead to get the timeline correct.

3 (not usable): the delta time start to start is buggy and is not reliable. This is calculated in wireshark.

===CSV===

It may be possible to use tshark and dump it out in CSV but tshark does not support the BTLE sniffer as it requires a device to be selected.

Can you use the python sniffer API that is bundled with the sniffer (see snifferAPI.zip) or the sniffer library from adafruit to achieve what you want ?

Does this help ?
David