Wireshark encryptet connection - show encrypted(not decrypted - raw) hexdump

[blebench]

Hello, I'm developing an debugging an BLE application.

I'm using nRF Sniffer (dongle) N51422 PCA10031.

I can successfully sniff and decrypt ble secured connections of my application.

My situation is, if i listen to an encrypted connection, Wireshark shows me the transferred data decrypted (in the Packet list and hexdump).


Is there any way to show the raw (encrypted) message data additionally?

I want to see the raw encrypted data (not decrypted). The reason is, that i want to verify/see if the data are really encryptet.




schematic Example:

application - Characteristic write message:  "hello world" (plaintext)

nRF sniffer (Wireshark) sniff following message: "hello world"(decrypted)  - hexdump includes same decrypted message

my requirement/wish:  nRF sniffer shows additionally  "encrypted hello world"(raw/encrypted) message in the hexdump.



I hope my question is understandable.

Thanks in forward for any helpful hints or advice.

[Hung Bui]

Hi, 

 

I believe the decryption is performed inside the sniffer hardware board, so the raw data is not sent to wireshark. 

If you want to debug, I would suggest you to read the radio package locally on the BLE device itself, assuming you have access to the device.