TShark will not capture BTLE packets with nRF sniffer

[jrx07]

I am having issues using tshark to capture BTLE advertising packets.

The system works very well with Wireshark. However, when I try to run `tshark` from the command line, it immediately quits and says "0 packets captured."

Any ideas why it may be working in Wireshark but not in Tshark?

Setup: I am using the nRF51 DK for the sniffer. This works well via the Wireshark GUI (version 2.6.1) as I mentioned. I have a peripheral device that is sending advertising packets and Wireshark easily detects them (i.e. I know the hardware works and there are advertising packets being sent).

Command used: After navigating to my Wireshark folder on the command line, I type:

tshark -i 6 -a duration:10

My nRF sniffer is interface 6. Everything is run on Windows 8.

Further Info: TShark works correctly if I try to capture wifi

tshark -i 1 -a duration:10

where interface 1 is the wifi interface.

Thanks!

[Håkon Alseth]

Hi,

 

Just checked internally, and there's no support in tshark for the nrf-sniffer, unfortunately.

You're able to list it (tshark -D), but tshark cannot setup the sniffer (no interface to follow/set adv channels etc), so it will just exit.

 

Best regards,

Håkon

[jrx07]

Hi Håkon,

Thank you for checking and for the quick reply.

Do you know of an easy way to automate packet capture using the nRF-sniffer so that it outputs CSV files?

I believe it's possible using some hacky methods with Wireshark, but they don't seem very reliable.

Best,

J

[Håkon Alseth]

Hi,

 

I am sorry, but I do not know of any such methods. Our main target for providing the nRF-sniffer is to use it as an interactive debugging tool during your development process, so we have not focused on automated capture processes.

nrf-sniffer v2 is still in beta, so we have a couple of bugs (or stability issues, especially on windows) which needs to be ironed out before we can focus on feature requests.

 

Best regards,

Håkon

[Matthew C Clark]

Hi, Håkon,

I see this remains the case with v3, unfortunately. It'd be very useful to me to have a tshark version as I'm trying to sniff from a smaller embedded device and push the results into a DB and a full GUI is too heavy for my needs.

Matt

[Håkon Alseth]

Hi Matt,

 

Sorry that we've disappointed you! :\ I can assure you that this isn't our intention.

I've bumped the internal feature request on t-shark support.

 

Kind regards,

Håkon

[Matthew C Clark]

I'd appreciate it!  Even a hack of the baseline v3 would be useful.  A version of the python script I could pipe into a tcpdump would be great.